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Abstract 
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The  purpose  of  this  study  was  to  explore  the  origin, 
evolution,  and  present  status  of  system  safety  in  the  Air 
Force  Systems  Command  (AFSC)  acquisition  process.  The 
study  had  five  objectives:  1)  Determine  the  origin  of 
system  safety.  2)  Describe  the  discipline  of  system 
safety.  3)  Explain  how  system  safety  has  evolved. 

4)  Determine  the  current  effectiveness  of  system  safety. 

5)  Determine  what  the  future. holds  for  system  safety. 

The  study  found  that  i^ystem  safety  was  first  applied 

■4- 

to  the  Minuteman  Missile  Program  in  1962.  Since  then,  its 
scope  has  expanded  and  its  governing  documents  have 
further  specified  responsibilities.  The  new  AFSC  Form  180 
is  required  by  the  AFSC  Supplement  to  AFR  800-16  to  be 
filled  out  and  signed  by  program  managers.  This  form 
shows  the  residual  risk  associated  with  each  hazard 
identified  in  a  system  and  documents  the  program  manager's 
acceptance  of  the  residual  risk.  Thirty-five  system 
safety  personnel  and  thirty-five  program  management  and 
engineering  personnel  from  the  four  AFSC  Product  Divisions 
were  interviewed  to  determine  the  current  effectiveness  of 
system  safety.  The  study  shows  that  system  safety  is 
considered  an  important  part  of  the  acquisition  process  — /  £ v A ? 


x 


and  cost-effective.  There  is  a  need  for  improved  software 
system  safety  in  the  future  along  with  a  continuing  need 
for  personnel,  -  ~  /-  ) 

Among  recommendations  of  the  study  were  soliciting 
emphasis  on  system  safety  from  higher  management  levels, 
including  system  safety  in  introductory  acquisition 
management  courses,  and  development  of  a  computerized 
lessons  learned  data  base  by  the  Air  Force  Inspection  and 
Safety  Center. 


A  BRIEF  HISTORY  OF  SYSTEM  SAFETY  AND  ITS 
CURRENT  STATUS  IN  AIR  FORCE  ACQUISITION  PROGRAMS 


1.  Introduction 

General  Issue 

The  discipline  of  system  safety  is  becoming 
increasingly  important  in  the  weapon  system  acquisition 
process.  Since  its  reputed  beginning  in  the  ballistic 
missile  programs  of  the  1960s,  system  safety  has  spread 
throughout  the  Department  of  Defense  and  the  world  of 
defense  contractors.  The  increasing  complexity  and  the 
tremendous  increase  in  the  cost  of  weapon  systems  gave 
rise  to  the  popularity  of  system  safety.  By  designing 
safety  into  the  systems  from  the  beginning,  life  cycle 
costs  can  be  reduced  along  with  increased  system 
reliability  (7:9).  System  safety  is  currently  receiving 
high-level  interest  in  an  extremely  dynamic  acquisition 
process  (12). 

Specific  Problem 

The  exact  beginning  of  system  safety  is  unclear.  It 
is  generally  believed  to  have  started  in  the  Air  Force 
ballistic  missile  programs  of  the  1960s  (11,12).  Since 
its  inception,  system  safety  has  grown  to  include  not  only 
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missiles,  but  most  major  weapon  systems  and  subsystems 
(2:1).  This  thesis  chronicles  the  evolution  of  system 
safety  in  the  Air  Force  from  its  first  application  to  the 
status  of  its  current  level  of  utilization.  It  also  draws 
conclusions  on  the  current  perceptions  and  effectiveness 
of  Air  Force  system  safety  programs  based  on  interviews  of 
system  safety  and  program  management  personnel. 

Investigative  Questions 

Looking  at  the  history  of  system  safety  in  the  Air 
Force  and  its  effectiveness  involved  answering  some 
questions  about  its  origin  and  the  discipline  itself. 

The  research  objectives  were  attained  by  answering  the 
research  questions  below  each  objective. 

1)  To  determine  the  origin  of  system  safety: 

a)  When  did  a  formal  system  safety  program  first 

appear? 

b)  Who  originated  it? 

c)  If  the  first  system  safety  program  appeared 

in  an  organization  other  than  the  Air  Force, 

when  did  the  Air  Force  adopt  the  innovation? 

2)  To  understand  the  discipline: 

a)  What  constitutes  system  safety? 

b)  How  is  it  applied  in  an  Air  Force  acquisition 

program? 
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3)  To  explain  the  evolution  of  system  safety: 

a)  How  has  it  changed  over  the  years? 

b)  How  have  the  governing  regulations  changed 

over  time? 

c)  What  are  the  benefits  of  an  effective  system 

safety  program? 

4)  To  determine  if  system  safety  is  currently 
effective : 

a)  Do  program  management  officials  value  the 

support  of  their  system  safety  managers? 

b)  Do  system  safety  managers  see  themselves  as 

being  worthwhile  to  the  programs  they 
support? 

c)  Are  system  safety  managers  qualified  and  able 

to  perform  their  jobs? 

5)  To  discover  what  may  happen  in  the  future: 

a)  Is  system  safety  still  developing? 

b)  What  are  some  current  issues/trends? 

By  exploring  the  answers  to  these  questions,  the 
development  of  the  discipline,  the  process  itself,  and  the 
effectiveness  of  system  safety  became  clear. 

Scope 

The  discipline  of  system  safety  can  currently  be 
found  throughout  the  Department  of  Defense  (DOD)  and  in 
many  defense  contractors'  management  structures  (3).  To 
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effectively  research  the  history  of  system  safety,  it  was 
necessary  to  restrict  the  scope  of  the  research.  It  was 
not  feasible  to  look  at  how  system  safety  is  applied  in 
each  military  service  and  contractor.  It  was,  however, 
possible  to  look  at  the  evolution  of  the  discipline  itself 
as  one  area,  and  the  evolution  and  application  of  system 
safety  to  Air  Force  acquisition  programs  as  another. 

Other  Safety  Concerns.  It  is  important  to  understand 
that  system  safety  is  only  one  area  in  the  safety  arena. 
Other  areas  include  flight  safety  and  ground  safety. 

Flight  safety  is  concerned  with  airborne  systems  already 
in  operation  (17).  Ground  safety  relates  mainly  to 
personnel  safety  in  an  occupational  surrounding,  and 
includes  industrial  safety  (15).  System  safety  deals  with 
the  design  of  systems  during  the  acquisition  process. 
System  safety  does,  however,  use  lessons  learned  from  both 
of  these  other  areas  in  order  to  prevent  hazards  from 
being  repeated  in  future  designs  (3). 

Discipl ine  of  System  Safety.  As  a  discipline,  system 
safety  transcends  the  boundaries  of  the  military  services 
and  defense  contractors.  When  a  development  in  system 
safety  is  made  in  one  organization,  it  will  eventually 
impact  the  application  of  the  discipline  in  all 
organizations.  For  this  reason,  this  thesis  considers  the 
general  evolution  of  the  discipline  of  system  safety  to  be 
a  superset  of  the  evolution  of  system  safety  in  the  Air 


Force.  The  evolution  and  significant  developments  of 
system  safety  as  a  whole  was  one  area  of  research. 

System  Safety  in  the  Air  Force .  To  effectively 
explore  how  system  safety  is  applied  in  an  acquisition 
process,  it  was  necessary  to  focus  attention  on  one 
particular  area.  This  thesis  concentrates  on  how  system 
safety  is  applied  during  an  Air  Force  Systems  Command 
acquisition  program.  In  addition,  the  evolution  of  the 
regulations  which  govern  the  Air  Force  system  safety 
program  are  discussed  rather  than  reviewing  the 
regulations  unique  to  all  of  the  other  services. 

Looking  at  the  general  development  of  the  discipline 
of  system  safety  and  then  describing  the  specific  aspects 
of  the  system  safety  process  in  the  Air  Force  effectively 
limited  the  scope  of  this  thesis. 

Background 

The  formal  discipline  of  system  safety  has  been 
around  for  over  20  years  (12,  12:1-6).  During  this  time, 
many  changes  have  taken  place  in  system  safety.  There  are 
many  informational  "how  to"  books  and  guides  to  aid  system 
safety  managers  and  engineers;  however,  few  people  outside 
of  the  discipline  itself  have  a  real  understanding  of  what 
system  safety  is. 

The  Air  Force  system  safety  program  is  directed  by 
DOD  Instruction  5000.36,  14  April  1986  (2:1).  There  are 
many  regulations  and  guidelines  that  are  used  to  manage 
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and  implement  system  safety  programs  in  the  Air  Force. 

The  two  major  documents  used  in  managing  Air  Force  system 
safety  programs  are  AFR  800-16  and  MIL-STD-882B . 

AFR  800-16 ,  USAF  System  Safety  Programs .  The  policy 
on  Air  Force  system  safety  programs  is  contained  in  AFR 
800-16.  Its  purpose  and  intent  are  best  explained  in  the 
regulation  itself:. 

This  regulation  explains  policy  on  system  safety 
programs  and  makes  Air  Force  activities  responsible 
for  carrying  out  that  policy  throughout  the  system 
life  cycle.  It  applies  to  all  commands,  the  US  Air 
Force  Reserve  (USAFR)  and  Air  National  Guard  (ANG), 
and  implements  DOD  Instruction  5000.36,  14  April 
1986.  It  requires  each  major  command,  separate 
operating  agency,  and  direct  reporting  unit  (MAJCOK, 
SOA,  DRU)  to  set  up  and  conduct  or  support  an 
effective  USAF  system  safety  program  (2:1). 

MIL-STD-882B,  System  Safety  Program  Requirements . 

While  AFR  800-16  states  that  system  safety  programs  must 

be  developed,  MIL-STD-882B  explains  how  to  develop  system 

safety  programs.  It  is  broken  up  into  different  tasks  to 

be  performed  by  the  contractor.  By  selectively  including 

only  the  tasks  necessary  in  a  contract,  the  system  safety 

program  is  tailored  to  each  system  (6:1-2).  By  tailoring 

the  system  safety  requirements  to  each  system,  money  is 

saved  by  not  requiring  the  contractor  to  perform  unneeded 

tasks . 

MIL-STD-882B  provides  the  following  overview  of  its 
overall  purpose: 

This  standard  provides  uniform  requirements  for 
developing  and  implementing  a  system  safety  program 
of  sufficient  comprehensiveness  to  identify  the 
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hazards  of  a  system  and  to  impose  design  requirements 
and  management  controls  to  prevent  mishaps  by 
eliminating  hazards  or  reducing  the  associated  risk 
to  a  level  acceptable  to  the  managing  activity  (6:1). 

There  are,  of  course,  many  other  regulations  and 

guidelines  that  govern  the  Air  Force  system  safety 

program,  however,  the  two  above  have  the  most  significant 

impact.  While  these  two  documents  contain  information  on 

system  safety,  other  steps  were  needed  to  answer  the 

research  questions. 
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II .  Methodology 


Method  of  Research 

The  research  design  I  used  to  answer  my  research 
questions  was  that  of  a  descriptive  study  and  structured 
Interviews.  The  information  I  gathered  pertains  to  the 
evolution,  contents,  and  effectiveness  of  the  system 
safety  discipline.  I  also  studied  the  application  of 
system  safety  in  the  Air  Force  Systems  Command  acquisition 
process.  To  effectively  gather  the  information  I  needed, 
several  different  steps  were  taken. 

My  information  was  gathered  by  interviewing  system 
safety  managers  and  program  management  officials,  as  well 
as  by  reviewing  literature  on  system  safety. 

Interviews.  My  interviews  were  done  in  person  when 
possible.  Because  of  the  scarcity  of  TDY  funds,  personnel 
stationed  at  locations  other  than  Wright-Patterson  AFB 
were  interviewed  by  telephone.  In  all  cases,  the 
interviews  were  conducted  using  the  structured  interview 
questions  contained  in  Appendices  A  and  B.  This  ensured 
that  the  same  questions  were  asked  every  individual . 

By  interviewing  system  safety  managers,  I  determined 
how  system  safety  programs  are  applied  in  an  acquisition 
program.  They  also  provided  valuable  information  on 
recent  changes  within  the  discipline  and  on  the  benefits 
of  an  effective  system  safety  program.  System  safety 
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managers  that  have  many  years  of  experience  were  an 
excellent  source  of  information  on  how  the  discipline  has 
evolved  and  spread  over  the  years.  The  main  thrust  of  the 
interviews  was  to  determine  how  the  system  safety  managers 
perceive  their  contribution  to  acquisition  programs  and  to 
determine  their  working  relationships  with  program 
management  personnel.  Air  Force  personnel  I  interviewed 
included  safety  personnel  from  Aeronautical  Systems 
Division  (ASD) ,  Electronic  Systems  Division  (ESD) ,  Space 
Division  (SD),  and  Armament  Division(AD) . 

Interviews  with  program  management  officials  gave  me 
a  more  objective  view  on  the  effectiveness  of  system 
safety  in  the  acquisition  process.  Their  perspectives  as 
managers  and  engineers  presented  the  perceived  benefits  of 
system  safety  on  their  programs.  I  interviewed  program 
managers  and  engineers  of  acquisition  programs  at  the  four 
AFSC  product  divisions.  These  individuals  gave  me  an 
understanding  of  what  kind  of  emphasis  is  currently  being 
placed  on  system  safety  and  what  some  of  the  current 
issues  are. 

Review  of  Documentation.  Reviewing  documentation  on 
system  safety  not  only  provided  information  on  the 
contents  of  the  discipline,  it  also  explained  the  origin 
and  evolution  of  system  safety.  Several  sources  were 
obtained  from  the  Defense  Technical  Information  Center 
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(DTIC) .  These  consisted  of  theses,  technical  reports, 
and  papers  done  by  military  students. 

Measures 

Table  1  shows  the  relationship  between  the  research 
objectives,  research  questions,  and  the  interview 
questions.  The  interview  questions  are  designed  to  answer 
research  questions,  however,  many  research  questions  were 
answered  using  documentation  rather  than  interviews. 
Research  objectives  1,  2,  and  3  were  all  attained  through 
searching  documentation  and  informational  interviews  with 
system  safety  personnel.  The  next  chapter  explains  the 
discipline  of  system  safety  and  its  benefits. 
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Table  I 


Relationship  Between  Research  Objectives,  Research 

Questions 

,  and  Interview  Questions 

Program  Management 
Interview  Question 

Answers  Research 
Question 

Answers  Research 
Objective 
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4a 

4 

6 

4a 

4 

7 

4a 

4 
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5a,  5b 

5 
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5b 

5 
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4c 
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4c 
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4 

4c 
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info 

info 

6 

info 

info 

7 

4a 

4 

8 

4b 

4 
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5a,  5b 
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III.  System  Safety  Program  Process  and  Benefits 


Responsibilities  of  Air  Force  System  Safety  Managers 

The  tasks  and  responsibilities  of  system  safety 
managers  are  too  varied  and  too  numerous  to  describe  them 
all.  A  few  of  the  major  duties  are  discussed  below. 

Review  Contractual  Documents  and  Plans .  The  system 
safety  manager  will  make  inputs  to  the  program  management 
plan  (PMP ) ,  the  statement  of  work  (SOW),  the 
specifications,  the  contract  data  requirements  list 
(CDRL),  and  ethers  (12).  By  doing  so,  the  manager  may  be 
tasking  the  contractor  to  do  millions  of  dollars  of  work 
for  the  Air  Force.  One  of  the  options  is  to  require  the 
contractor  to  perform  hazard  analyses  in  the  statement  of 
work  (6:202-1  -  205-1). 

Hazard  Analyses .  The  purpose  of  hazard  analyses 
is  to  identify  hazards  and  show  how  they  will  be 
eliminated  or  controlled  (6:101-2).  The  four  types  of 
hazard  analyses  are:  preliminary  hazard  analysis  (PHA) , 
subsystem  hazard,  analysis  (SSHA),  system  hazard  analysis 
(SHA),  and  operational  and  support  hazard  analysis 
(O&SHA) . 

Preliminary  Hazard  Analysis .  The  PHA  is 
performed  early  in  the  life  cycle  of  a  system  to  determine 
which  general  areas  may  pose  potential  problems  later  in 
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the  system's  development  (6:202-1).  It  is  a  broad 
analysis  and  is  required  as  a  minimum  on  all  system  safety 
programs  (2:4). 

Subsystem  Hazard  Analysis .  The  SSHA  is 
performed  on  the  subsystems  of  a  system  to  identify  and 
control  hazards  in  each  subsystem  which  may  degrade  safety 
or  end  in  a  failure  of  a  system  (6:203-1).  Examples  of 
subsystems  are  engines,  landing  gear,  etc. 

Fault  Tree  Analysis  (FTA) .  This  is  a 
top-down  analysis  which  starts  with  an  undesired  event  and 
continues  through  the  system  to  determine  the  event  or 
combination  of  events  that  could  cause  the  undesired  event 
(5: 14) . 

Sneak  Circuit  Analysis  (SCA) .  An  SCA 
is  an  analysis  that  identifies  latent  (sneak)  circuits  and 
conditions  that  may  inhibit  desired  functions  or  cause 
undesired  functions  without  a  component  failure.  It  can 
be  conducted  on  either  software  or  hardware  (5:14). 

System  Hazard  Analysis .  The  SHA  is 
performed  on  the  entire  system  with  particular  emphasis  on 
the  subsystem  interfaces.  It  will  also  include  a  look  at 
human  errors  which  could  result  in  mishaps  (6:204-1). 

Operating  and  Support  Hazard  Analysis .  The 
O&SHA  is  performed  to  identify  and  control  hazards 
associated  with  the  use  of  the  system  throughout  its  life 
cycle  (6:205-1).  This  analysis  will  generate  many 
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cautions  and  warnings  on  the  hardware  itself  or  in 
technical  data. 

Order  of  Precedence .  In  all  of  the  hazard 
analyses,  an  order  of  precedence  is  followed  when 
determining  how  to  handle  the  hazards  identified. 
Obviously,  the  best  solution  to  a  hazard  is  to  design  the 
hazard  out  of  the  system.  In  many  cases,  unfortunately, 
this  solution  is  not  feasible.  The  elimination  of  the 
hazard  may  be  too  costly  or  necessary  to  the  operation  of 
the  system  (e.g.,  fuel  in  an  aircraft).  The  next  step  is 
to  use  a  safety  device  to  interlock  or  guard  the  hazard. 

If  this  is  also  unfeasible,  a  warning  device,  such  as  a 
bell  or  horn,  will  be  used  to  call  attention  to  the 
hazard.  When  all  of  these  actions  are  impractical,  the 
last  resort  is  to  use  special  procedures,  such  as  caution 
and  warning  notes,  to  avoid  the  hazard  (6:6). 

Advisor  to  Program  Manager  on  System  Safety.  The 
system  safety  manager  is  the  person  the  program  manager 
will  contact  if  there  is  a  question  about  system  safety 
(12).  There  should  be  a  direct  line  of  communication 
between  the  program  manager  and  the  system  safety  manager. 

It  is  important  to  realize  that  the  system  safety 
manager  is  trying  to  minimize  the  risk  of  mishaps 
associated  with  a  system,  however,  it  is  the 
responsibility  of  the  program  manager  to  accept  any  risk 
associated  with  the  system  (11).  If  the  system  safety 
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manager  identifies  a  hazard  and  thinks  it  should  be 
eliminated  or  controlled,  the  final  decision  is  up  the 
program  manager's.  He  may  decide  to  accept  the  risk 
against  the  recommendation  of  the  system  safety  manager. 
The  system  safety  manager  must  ensure  that  the  risk  the 
program  manager  is  assuming  is  fully  understood  by  the 
program  manager  (11). 

Key  Coordination  Point  in  System  Program  Office 
(SPO) .  The  system  safety  manager  is  required  to 
coordinate  on  nearly  all  program  documentation  (.11).  Of 
particular  importance  are  the  test  and  evaluation  master 
plan  (TEMP)  and  the  engineering  change  proposals  (ECPs) 
(12).  The  TEMP  is  important  because  a  flight  safety 
certification  must  be  developed  before  an  aircraft  or 
aircraft  subsystem  can  be  flown.  The  system  safety 
manager  is  an  important  part  of  this  process  (11). 

ECPs  are  changes  to  a  system's  design.  The  system 
safety  manager  must  monitor  these  to  assess  their  impact 
on  the  safety  of  the  system.  If  there  is  an  impact  to  the 
safety  of  the  system,  additional  analysis  may  be 
necessary,  or  the  system  safety  manager  may  not  approve 
the  change.  Being  a  member  of  the  Configuration  Control 
Board  (CCB),  which  reviews  and  adopts  or  rejects  ECPs,  the 
system  safety  manager  may  vote  against  an  ECP.  In  such 
cases,  it  again  becomes  the  program  manager's 
responsibility  to  make  the  final  decision. 
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Monitor  Contractors 1  Performance .  The  system  safety 
manager  monitors  the  contractors'  performance  in  the 
system  safety  area  to  ensure  they  are  fulfilling  their 
contractual  obligations  (12).  If  they  are  not,  the  system 
safety  manager  must  work  with  the  program  manager  and  the 
contracting  people  to  correct  any  deficiencies.  It  is 
also  the  system  safety  manager's  responsibility  to  make 
sure  the  contractor  is  providing  meaningful  information 
that  is  effective.  It  is  possible  that  the  contractor  is 
submitting  information  that  is  not  applicable  to  his 
program.  For  example,  a  contractor  on  on  aircraft  program 
submitted  quantified  hazard  analyses  with  probabilities 
that  were,  in  fact,  generated  by  another  contractor  a 
different  program  (11).  Again,  if  the  information  isn't 
meaningful,  the  system  safety  manager  must  help  to  correct 
the  situation. 

These  are  only  a  few  of  the  responsibilities  of  the 
system  safety  manager.  If  a  system  safety  manager  is 
effective  in  his  job,  the  program  manager  and  the  program 
will  benefit  in  many  ways. 

Benefits  of  an  Effective  System  Safety  Program 

The  benefits  of  system  safety  are  easily  understood. 
An  effective  system  safety  program  will  save  money  and 
improve  combat  capability,  however,  its  nearly  impossible 
to  quantify  (12,  13:1-1-1-7). 
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Reduce  Life  Cycle  Cost .  By  integrating  an  effective 
system  safety  program  at  a  program's  inception,  it  will 
have  more  than  paid  for  itself  by  the  end  of  the  system's 
life  cycle. 

The  cost  of  design  changes  rises  dramatical ly  as  the 
acquisition  process  matures.  By  the  time  a  system  is  in 
full  production,  a  design  change  will  cost  54  times  as 
much  as  it  would  have  during  the  conceptual  phase  (12). 

By  identifying  hazards  as  early  as  possible,  future 
changes  are  reduced,  thereby  saving  money. 

The  elimination  or  control  of  hazards  early  in  the 
life  cycle  not  only  saves  money,  it  will  also  save 
resources.  If  the  number  of  damaged  or  destroyed  systems 
is  reduced  by  an  effective  system  safety  program,  the 
savings  is  very  high.  With  the  increasing  cost  of  weapons 
systems,  this  potential  savings  continues  to  grow  (13:1-2 
-  1-7). 

Human  resources  may  also  be  saved  by  an  effective 
system  safety  program.  If  the  number  of  aircraft  lost  due 
to  preventable  mishaps  is  lowered,  a  reduction  in  airman 
fatalities  is  almost  certain  to  follow.  Thus,  system 
safety  can  save  money  and  lives. 

Increase  Combat  Capabi 1 ity .  The  conservation  of 
resources,  both  men  and  equipment,  that  can  be  saved  by  an 
effective  system  safety  program  directly  impacts  combat 
capability.  By  not  losing  aircraft  and  pilots,  the  number 
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of  aircraft  the  Air  Force  can  have  in  the  air  is 
increased. 

The  downtime  that  is  avoided  by  identifying  hazards 
early  in  the  system’s  life  cycle  will  also  increase  combat 
capability.  The  fewer  retrofits  a  system  undergoes,  the 
more  time  it  is  available  to  perform  its  mission. 

Quantifying  the  Benefits  of  System  Safety ■  The 
nature  of  system  safety  makes  it  nearly  impossible  to 
measure  its  effectiveness.  The  payoff  for  an  effective 
system  safety  program  is  a  mishap  not  occurring.  How  can 
an  event  not  occurring  be  measured?  As  Miller  and  Fro la 
state,  "It  is  like  trying  to  measure  how  much  illness,  has 
been  avoided  by  proper  nutrition"  (13:1-4).  If  a  design 
change  is  made  due  to  a  hazard  being  identified  through 
hazard  analysis,  it's  impossible  to  actually  prove  that 
the  design  change  actually  prevented  an  accident  (12). 

For  this  reason,  system  safety  is  sometimes  faced  with 
trying  to  justify  its  existence.  Top  level  management 
support  is  essential  to  the  development  of  an  effective 
system  safety  program. 

Success  Stories .  To  illustrate  the  possible 
benefits  of  system  safety,  two  examples  of  system  safety 
impacts  to  recent  acquisition  programs  are  presented 
below: 

During  a  modification  to  the  B-52,  a  system  safety 
engineer  noted  that  if  the  front  lugs  of  the  Air- 
Launched  Cruise  Missile  attachment  retracted  but  the 
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rear  ones  did  not,  parts  of  the  pylon  would  tear 
from  the  wing  and,  together  with  the  missile,  would 
inflict  severe  structural  damage  to  the  wing  and 
possibly  the  horizontal  stabilizer.  The  system  was 
redesigned  (13:1-5). 

A  safety  engineer  found  in  the  PAVE  LOW  helicopter 
system  that  loss  of  voltage  in  a  radar  circuit  would 
cause  a  command  to  the  aircraft  to  fly  at  zero 
altitude  with  no  warning  to  the  pilot.  He  also 
checked  with  personnel  on  the  RF-4C  and  A-7D 
programs,  knowing  they  used  the  same  system.  All 
aircraft  were  quickly  prohibited  from  flying  certain 
low-level  missions  until  the  systems  were  corrected 
(13:1-5) . 

Now  that  the  discipline  itself  has  been  explained, 
the  history  of  system  safety  can  be  explored. 
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IV.  Brief  History  of  System  Safet 


The  concept  of  safety  has  always  existed  in  the 
acquisition  and  operation  of  weapon  systems.  Weapon 
systems  are  intended  to  perform  their  missions  without 
inflicting  Casualties  and/or  damage  to  innocent  parties  or 
equipment.  This  resulted  in  systems  being  acquired  that 
had  a  reasonably  good  chance  of  completing  a  mission. 

When  a  mishap  occurred,  however,  an  investigation  was 
conducted  to  determine  the  cause  of  the  accident (9 : 23 ). ' 

If  the  cause  was  serious  and  it  was  determined  that  it  was 
likely  to  happen  again  in  the  future,  a  change  was 
Implemented  to  redesign  the  system.  This  "fly-fix-fly" 
attitude  was  expensive  due  to  the  costs  of  retrofitting 
systems  that  were  already  operational.  During  the  course 
of  retrofitting  an  entire  system,  extensive  downtime  was 
experienced  which  negatively  impacted  the  combat 
capability  of  the  system.  Also,  in  some  cases  the  design 
change  could  take  years  to  be  completed  in  all  operational 
systems.  This  was  not  only  an  inconvenience,  but  there 
was  always  the  risk  of  a  repeat  mishap  occurring  while  the 
change  was  being  implemented.  As  technology  improved  and 
the  cost  of  developing  and  producing  weapon  systems 
skyrocketed,  it  became  apparent  that  there  had  to  be  a 
more  efficient  way  of  doing  business ( 13 : 1-6) . 


First  Formal  System  Safety  Program 

Ironically,  though  the  first  system  safety  program  to 
be  developed  was  in  the  Air  Force,  it  was  not  applied  to 
an  aircraft  development  program.  The  Ballistic  Missile 
Division  (BMD)  was  involved  in  the  operational  testing  and 
site  activation  of  the  first  intercontinental  ballistic 
missiles  (ICBM)  in  the  late  1950's  and  early  1960's. 

During  the  course  of  this  testing,  BMD  experienced 
numerous  mishaps.  Five  missile  silos  were  destroyed 
costing  millions  of  dollars.  At  least  five  people  were 
also  killed  as  a  result  of  mishaps(14: 1-1) .  One 
particular  incident  that  created  a  great  deal  of  concern 
was  an  inadvertent  launch  at  Cape  Canaveral  in  1959.  A 
short  in  a  battery  was  found  to  have  caused  the  missile  to 
launch  accidently.  Fortunately,  the  missile  was  able  to 
be  destroyed  before  it  was  over  Cuba  (10).  This  all  added 
up  to  a  very  low  launch-success  rate  and  many  schedule 
delays.  During  the  investigations  of  these  mishaps,  it 
was  determined  that  a  large  percentage  of  the  causes  were 
direct  results  of  design  deficiencies,  poor  operational 
planning,  and  ill-conceived  management  decisions.  With 
this  discovery  came  the  realization  that  the  key  to 
preventing  mishaps  lay  in  the  design  and  production  of  the 
missile  rather  than  correcting  the  design  after  it  fails 
(14:1-1) . 
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In  April  1962,  BMD  produced  the  exhibit  "System 
Safety  Engineering  for  the  development  of  Air  Force 
Ballistic  Missiles."  This  document  outlined  the  system 
safety  requirements  for  the  associated  contracts  on  the 
Minuteman  Missile  program.  Thus  was  born  the  first  formal 
system  safety  effort(9 : 29) .  This  document  was  revised  in 
September  1963  and  became  MIL-S-38130,  "Military 
Specification-General  Requirement  for  Safety  Engineering 
of  Systems  and  Associated  Subsystems  and  Equipment."  In 
June  1966,  this  specification  was  furthur  revised  and 
became  MIL-S-38130A.  Finally,  in  July  1969,  another 
revision  was  made  and  the  specification  became  MIL-STD- 
882.  "System  Safety  Program  for  Systems  and  Associated 
Subsystems  and  Equipment."  MIL-STD-882  then  became  a 
mandatory  requirement  on  all  DOD  procured  products  and 
systems (16: 12) . 

Evolution  of  MIL-STD-882 

The  stated  purpose  of  MIL-STD-882  is  as  follows: 

The  purpose  of  this  standard  is  to  provide  uniform 
requirements  and  criteria  for  establishing  and 
implementing  system  safety  programs  and  to  provide 
guidelines  for  preparing  system  safety  program 
plans  (SSPP) .  (4:1) 

The  standard  spells  out  the  requirements  of  system 
safety  in  acquisition  programs.  It  establishes  four 
levels  of  hazard  severity  ranging  from  negligible  to 
catastrophic.  The  levels  were: 
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Category  I  —  negligible 

Category  II  —  marginal 

Category  III  —  critical 

Category  IV  —  catastrophic 

General  guidelines  for  system  safety  requirements 

during  the  different  phases  of  the  acquisition  cycle  are 

outlined.  It  includes  the  order  of  precedence  for 

overcoming  hazards  described  in  the  previous  chapter.  The 

four  major  types  of  hazard  analysis  (PHA,  SSHA,  SHA,  OHA) 

are  described.  An  appendix  outlines  a  proposed  format  for 

a  system  safety  program  plan  to  be  submitted  by 

contractors.  The  approved  SSPP  would  then  become  the 

basis  for  contractual  compliance  (4:3-16). 

MIL-STD-882A.  MIL-STD-882A  states  its  purpose  as: 

This  standard  provides  uniform  requirements  for 
developing  and  implementing  a  system  safety  program 
of  sufficient  comprehensiveness  to  identify  the 
hazards  of  a  system  and  to  ensure  that  adequate 
measures  are  taken  to  eliminate  or  control  the 
hazards  (5:1). 

The  first  readily  apparent  difference  in  this  version 
is  the  emphasis  in  the  purpose  on  identifying  and  then 
eliminating  or  contolling  hazards  rather  than  just 
establishing  a  system  safety  program.  It  includes  a 
section  on  the  responsibilities  of  the  managing  activity 
(HA)  and  the  contractor.  MIL-STD-882A  also  adds  a  section 
on  hazard  probabilities  which  denote  the  likelihood  of 
hazards  occurring.  These  are  combined  with  the  hazard 


levels  to  determine  the  criticality  of  hazards.  These 


probabilities  are: 

Descriptive  Words  Category 

Frequent  A 

Reasonably  probable  B 

Occasional  C 

Remote  D 

Extremely  improbable  E 

Impossible  F 


The  hazard  severity  levels  of  MIL-STD-882  were  also 
reversed  so  that  a  category  I  hazard  became  catastrophic, 
category  II  -  critical,  category  III  -  marginal,  and 
category  IV  -negligible.  Fault  tree  analysis  is  also 
discussed  for  the  first  time  (5:3-16). 

MIL-STD-882B.  The  purpose  of  MIL-STD-882B  reads  as 
follows: 

This  standard  provides  uniform  requirements  for 
developing  and  implementing  a  system  safety  program 
of  sufficient  comprehensiveness  to  identify  the 
hazards  of  a  system  and  to  impose  design  requirements 
and  management  controls  to  prevent  mishaps  by 
eliminating  hazards  or  reducing  the  associated  risk 
to  a  level  acceptable  to  the  managing  activity  (MA) . 
(6:1) 

The  purpose  statement  of  MIL-STD-882B  has  now  shifted 
from  eliminating  or  controlling  hazards  to  eliminating 
hazards  or  reducing  risk  to  acceptable  levels.  This 
recognizes  that  no  system  is  ever  completely  free  of  risk. 
The  format  of  this  standard  is  almost  entirely  different 
than  previous  versions.  It  contains  task  descriptions 
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that  can  be  selectively  applied  to  acquisition  programs. 
This  allows  the  MA  to  tailor  the  system  safety  program  to 
each  system.  The  task  descriptions  are  divided  int„  two 
general  sections:  Section  100,  Program  Management  and 
Control  and  Section  200,  Design  and  Evaluation.  The 
standard  also  contains  two  appendices  that  provide 
guidance  and  rationale  for  selecting  tasks  to  be  applied 
to  different  systems.  One  significant  task  that  is 
included  in  MIL-STD-882B  calls  for  the  performance  of 
software  safety  hazard  analysis  (6:1  -  212-1). 

Evolution  of  AFR  800-16 ,  USAF  System  Safety  Programs 
AFR  800-16  was  first  published  6  June  1979.  It 
explains  the  USAF  policy  for  system  safety.  It  superseded 
AFR  127-8,  dated  19  April  1976.  This  change  removed  the 
regulation  from  the  127-safety  series  of  regulations  and 
placed  it  in  the  800-acquisition  series.  This  helped 
place  emphasis  on  the  integration  of  system  safety  into 
the  design  and  development  of  weapon  systems.  It  also 
required  the  implementing  command  to  formally  document  the 
acceptance  of  risk  associated  with  identified  hazards. 

This  version  addressed  system  safety  requirements  to  off- 
the-shelf  procurement  items,  but  only  for  Air  Force 
Logistics  Command  (AFLC)  programs.  It  also  requires  the 
identification  and  maintenance  of  safety  critical  items 
listings;  these  being  items  that  can  fail  and  create  a 
potential  for  major  injury  or  damage  (1:1  -  6). 
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AFR  800-16 ,  21  August  1987 .  This  regulation  is 
currently  in  effect.  The  major  implication  of  this 
revision  is  the  requirement  for  all  implements  g  and  using 
commands  to  publish  supplements  to  the  basic  regulation. 

It  also  requires  independent  safety  assessments  at  major 
program  milestones,  and  requires  Headquarters  USAF  to 
formally  accept  the  residual  risk  for  major  programs.  It 
removes  all  references  to  safety  critical  items,  and 
clarifies  and  expands  the  responsibilities  of  the  using 
commands.  This  revision  adds  a  separate  section  on 
off-the-shelf  procurements.  This  section  adds 
responsibilities  to  the  implementing  commands,  rather  than 
just  to  AFLC  programs.  It  also  adds  the  requirement  for 
supporting  commands  to  develop  hazardous  materials 
programs  to  meet  the  rising  need  for  such  emphasis 
(2:1  -12) . 

AFSC  Supplement,  AFR  800-16,  9  February  1988 .  While 
this  supplement  isn't  another  revision  of  AFR  800-16  as 
such,  it  does  modify  the  regulation  consistent  with  the 
scope  of  this  thesis.  Its  purpose  is  to  further  define 
AFSC.' s  responsibilities  in  system  safety  programs.  It 
stresses  preventing  hazards  from  being  designed  into 
systems  developed,  acquired,  or  modified  by  AFSC.  It  also 
emphasizes  accountability  for  residual  risk.  The 
supplement  introduces  AFSC  Form  180,  Residual  Risk 
Assessment/Acceptance .  This  form  is  to  be  used  to 
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identify  the  risk  associated  with  each  hazard  identified 
within  the  system.  Each  Form  180  i3  then  signed  by  the 
chief  engineer  and  the  program  manager  (3:1  -  2).  This 
ensures  that  program  management  is  fully  aware  of  the  risk 
existing  in  the  system  (8:6  -  10).  The  supplement 
contains  instructions  on  filling  out  Form  180  and  provides 
a  completed  example  (3:3-4). 

The  development  of  system  safety  has  been  a  constant 
process.  To  determine  the  present  status  and  mood  of 
system  safety,  interviews  were  conducted.  The  results  of 
these  interviews  are  contained  in  the  next  chapter. 
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V. 


Data  Analysis  and  Findings 


Data  Analysis 

This  chapter  presents  the  results  of  the  data 
collected  by  the  structured  interviews  to  further  satisfy 
the  research  objectives  presented  in  Chapter  one-.  A  total 
of  seventy  interviews  were  conducted.  Thirty-five  system 
safety  personnel  were  interviewed,  along  with  thirty-five 
program  management/engineering  personnel.  These  seventy 
individuals  are  members  of  Armament  Division,  Space 
Division,  Electronic  Systems  Division,  and  Aeronautical 
Systems  Division  of  Air  Force  Systems  Command. 

Responses  are  presented  from  each  product  division 
and  then  an  overall  summary.  Each  question  from  both 
structured  interviews  will  be  addressed  separately. 
Questions  one  through  six  of  the  system  safety  personnel 
interview  were  used  to  determine  the  education, 
experience,  training,  and  current  responsibilities  of  the 
interviewees.  Questions  seven  through  nine  will  be 
discussed  from  the  standpoint  of  a  majority  opinion  and  a 
minority  opinion.  Questions  one  through  four  and  question 
nine  of  the  program  management/engineering  personnel 
interview  were  used  to  determine  knowledge  and  awareness 
of  system  safety  and  current  responsibilities.  Questions 
five  through  eight  will  again  be  discussed  using  the 
majority/minority  opinion  format.  It  should  be  noted  that 
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because  of  simple  yes/no  responses  and  some  respondents 
giving  more  than  one  comment  to  some  questions,  in  some 
cases  the  number  of  respondents  do  not  seem  to  add  up 
correctly.  This,  however,  is  not  the  case. 

Interviewees  were  assured  that  their  responses  would 
be  confidential.  For  this  reason,  most  of  the  statements 
quoted  in  the  findings  section  will  remain  anonymous. 

Findings 

Of  the  seventy  interviewees,  six  were  from  Electronic 
Systems  Division,  ten  from  Armament  Division,  twelve  from 
Space  Division,  and  forty-two  from  Aeronautical  Systems 
Division.  Half  of  each  division's  interviewees  were  from 
system  safety,  the  others  were  from  program 
management/engineering.  The  large  number  of  Aeronautical 
Systems  Division  is  due  to  their  proximity  and  the  large 
number  of  system  safety  personnel. 

Interview  Results 

Electronic  Systems  Division  —  System  Safety 
Personnel . 

Question  One .  What  is  your  current  duty  title? 
One  of  the  three  respondents  include  system  safety  in 
their  duty  title.  The  Director  of  Safety  has  the 
responsibility  for  all  areas  of  safety,  including  system 
safety,  as  does  the  Deputy  Director  of  Safety. 
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Question  Two .  What  is  your  educational 


background?  All  three  persons  have  undergraduate  degrees 
in  engineering  and  graduate  degrees  in  management-related 
fields. 

Question  Three .  How  much  experience  do  you  have 
in  system  safety?  All  three  interviewees  have  three  or 
more  years  of  system  safety  experience. 

Question  Four.  What  system  safety  training  have 
you  had?  The  system  safety  manager  course,  formerly 
taught  by  the  University  of  Southern  California  (currently 
taught  by  the  University  of  Washington)  was  attended  by 
all  three  individuals.  Two  had  additional  training  from 
other  courses. 

Question  Five .  What  programs  do  you  currently 
have  system  safety  responsibility  f jr?  Since  the  system 
safety  function  at  ESD  acts  as  a  staff  function,  the 
interviewees  had  system  safety  responsibilities  for  all  of 
the  ESD  programs.  This  results  in  the  personnel  being 
responsible  for  more  than  one  program. 

Question  Six.  What  office  is  your  reporting 
official  located  in?  .  This  question  was  designed  to  see  if 
the  system  safety  personnel  had  a  direct  line  of 
communication  to  the  program  managers.  As  a  staff  office, 
they  do  have  direct  lines  of  communication  to  the  ESD 
program  managers . 
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Question  seven.  How  would  you  describe  your 
working  relationship  with  the  program  office  personnel  you 
work  with? 

Majority  Opinion.  All  three  individuals 
conveyed  some  kind  of  concern  with  their  relationships 
with  program  office  personnel.  One  response  was,  "it 
varies  from  excellent  to  non-existent"  depending  on  the 
program  in  question.  The  overall  feeling  was  that  their 
system  safety  programs  are  given  a  low  priority.  One 
unidentified  program  manager  was  quoted  as  saying,  "these 
are  ground  systems,  they  don't  have  hazards."  As  an 
aside,  shortly  after  the  program  manager  made  this 
statement,  one  of  the  systems  was  damaged  by  fire. 

Minority  Opinion.  The  minority  opinion  was 
stated  in  the  above  quote  referencing  excellent  support  on 
some  programs. 

Question  Eight.  What  are  your  views  on  the 
impact  your  system  safety  program  has  on  your  acquisition 
programs? 

Majority  Opinion.  All  of  the  lnterviewee& 
believe  that  their  efforts  are  very  effective  when  they 
are  allowed  to  do  their  jobs.  However,  all  three 
mentioned  that  in  many  cases  their  inputs  are  eliminated 
due  to  funding  cuts.  All  think  that  their  impact  is 
somewhat  restricted. 
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Minority  Opinion.  Ho  minority  opinion  was 


expressed . 

Question  Nine .  What  trends  are  developing  in 
the  discipline  of  system  safety? 

Majority  Opinion.  All  three  respondents 
feel  that  the  recent  budget  cuts  and  the  future  budget 
cuts  have  and  will  result  in  more  streamlined  system 
safety  programs . 

Minority  Opinion.  While  all  of  the 
interviewees  believe  the  future  holds  reduced  system 
safety  efforts,  two  of  the  three  anticipate  an  increased 
emphasis  being  placed  on  system  safety.  While  this  seems 
contradictory,  it  is  not  necessarily  so.  While  the  system 
safety  efforts  may  be  reduced  in  scope,  the  remaining 
program  may  be  considered  more  important.  One  respondent 
attributes  this  increase  in  emphasis  on  system  safety  to 
the  new  ESD  Vice  Commander. 

Electronic  System  Division  —  Program  Management 
Personnel . 

Question  One .  What  is  your  current  duty  title? 
Two  of  the  three  respondents  were  program  managers .  The 
third  was  an  engineer. 

Question  Two .  What  acquisition  programs  are  you 
responsible  for?  All  three  individuals  identified 
themselves  with  one  specific  program,  however,  in  one  case 


the  individual  was  responsible  for  many  projects  under  the 
main  program. 

Question  Three .  How  familiar  are  you  with  the 
discipline  of  system  safety?  All  three  admitted  that  they 
knew  little  about  system  safety. 

Question  Four.  Do  you  know  who  has  system 
safety  responsibility  for  your  programs?  Two  of  the  three 
interviewees  did  know  who  their  programs'  system  safety 
managers  were.  One  stated  that  he  had  no  idea. 

Question  Five .  How  do  you  view  the  discipline 
of  system  safety? 

Majority  Opinion.  All  three  of  the 
interviewees  stated  that  system  safety  is  an  important 
consideration  in  an  acquisition  process.  Its  value  to 
electronics  integration  was  mentioned  by  two  of  the 
interviewees.  One  stated  that  the  higher  the  value  of  the 
equipment  in  question,  the  more  important  system  safety 
becomes . 

Minority  Opinion.  No  minority  opinion  was 

expressed. 

Question  Six.  Does  system  safety  contribute  to 
your  programs? 

Majority  Opinion.  Two  of  the  three 
respondents  felt  very  sure  that  system  safety  is 
positively  contributing  to  their  programs. 
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Minority  Opinion.  One  interviewee  said 
that  he  was  neutral  on  the  subject;  that  he  couldn't  say 
that  system  safety  contributed  to,  or  hindered,  his 
program . 

Question  Seven .  Is  system  safety  cost- 

effective? 

Majority  Opinion.  All  three  individuals 
think  that  system  safety  is  cost-effective,  but  all  had 
qualifiers.  One  stressed  that  it's  most  cost-effective 
when  done  during  the  design  phase,  not  when  it's  done 
after  the  system  is  operational.  Two  stated  that  it's 
cost-effective  if  the  system  safety  program  is  tailored  to 
each  specific  program,  thereby  eliminating  unnecessary 
costs . 

Minority  Opinion.  Mo  minority  opinion  was 

expressed. 

Question  Eight .  How  could  system  safety  be 
improved  to  enhance  its  value  to  your  programs? 

Majority  Opinion.  All  three  respondents 
presented  different  ideas  to  the  question.  No  majority 
opinion  was  expressed. 

Minority  opinion.'  One  individual  thinks 
system  safety  is  effective  the  way  it  is  and  that  the 
contractors  are  also  applying  system  safety  effectively. 
Another  respondent  urges  more  involvement  earlier  in  the 
acquisition  process  to  the  advantage  of  the  low  cost  of 
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design  changes.  The  last  respondent  was  more  specific: 
he  wants  an  alternative  to  Halon  fire  suppression  systems 
because  of  the  difficulty  in  supporting  them. 

Question  Wine .  Have  you  received  any  guidance 
from  higher  headquarters  concerning  system  safety?  Only 
one  of  the  three  interviewees  recalls  having  seen  any 
correspondence  from  higher  headquarters  concerning  system 
safety.  He  couldn't  remember  what  it  addressed,  but  said 
it  came  from  TAC  Headquarters. 

Armament  Division  —  System  Safety  Personnel . 

Question  One .  What  is  your  current  duty  title? 
Four  of  the  five  interviewees  include  engineer  in  their 
duty  title.  The  fifth  includes  system  safety. 

Question  Two .  What  is  your  educational 
background?  Four  of  the  five  interviewees  have 
undergraduate  degrees  in  engineering.  Three  of  the 
respondents  also  have  graduate  degrees  in  engineering  or 
management . 

Question  Three ■  How  much  experience  do  you  have 
in  system  safety?  The  least  experienced  of  the 
individuals  has  five  years  of  experience.  Three  of  the 
five  have  over  twenty  years  of  experience  in  system 
safety.  The  mean  number  of  years  experience  in  this 
sample  is  IS  years.  The  value  of  this  experience  to  the 
system  safety  effort  at  Armament  Division  is 


obvious . 


Question  Four .  What  system  safety  training  have 
you  had?  All  five  respondents  have  completed  both  the 
system  safety  manager  course  and  the  fault  tree  analysis 
course  offered  by  the  University  of  Washington. 

Question  Five .  What  programs  do  you  currently 
have  system  safety  responsibilities  for?  The  AD  System 
Safety  Directorate  acts  as  a  staff  office.  Thus,  all  five 
respondents  cover  numerous  acquisition  programs. 

Question  Six.  What  office  is  your  reporting 
official  located  in?  All  five  persons  interviewed  report 
to  people  in  the  Deputy  for  Safety. 

Question  Seven .  How  would  you  describe  your 
working  relationship  with  the  program  office  personnel  you 
work  with? 

Majority  Opinion.  Four  of  the  five 
respondents  stated  that  they  have  excellent  working 
relationships  with  the  SPO  personnel  at  AD.  Two  of  these 
four  credit  their  good  rapport  to  the  fact  that  in  many 
cases  the  system  safety  personnel  provide  the  corporate 
memory  for  the  programs.  Another  says  SPOs  are  responsive 
to  the  system  safety  inputs  because  of  their  position  as  a 
staff  office. 

Minority  Opinion.  One  individual  states 
that,  historically,  the  working  relationship  between 
system  safety  and  the  SPOs  hasn't  been  very  good.  He 
states  that  the  SPOs  are  usually  so  intent  on  fielding  a 
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system,  they  lose  their  insight  into  system  safety 
requirements . 

Question  Eight.  What  are  your  views  on  the 
impact  your  system  safety  program  has  on  your  acquisition 
programs? 

Majority  Opinion.  Four  of  the  five  people 
interviewed  consider  system  safety  to  have  a  major  impact 
on  acquisition  programs.  Two  of  the  respondents  credit 
this  impact  to  the  fact  that  most  AD  programs  must  be 
certified  by  the  Nonnuclear  Munitions  Safety  Board  (NNMSB) 
before  they  can  be  fielded.  This  enables  the  system 
safety  manager  to  ensure  his  requirements  are  met  in  order 
to  pass  the  NNMSB  review.  Two  other  respondents  mentioned 
that  it  was  tougher  to  make  contractors  pay  attention  to 
safety  than  the  Air  Force. 

Minority  Opinion.  One  individual  stated 
that  system  safety  had  some  impact  on  programs,  but  it 
ususally  takes  a  catastrophic  event  to  get  attention.  He 
mentioned  that  he  thought  the  Challenger  mishap  increased 
the  acceptance  of  system  safety. 

Question  Nine.  What  trends  are  developing  in 
the  discipline  of  system  safety? 

Majority  Opinion.  Three  of  the  respondents 
believe  that  system  safety  is  getting  more  and  more 
emphasis  in  the  acquisition  business.  Two  of  them  credit 
the  Challenger  mishap  for  this  increased  emphasis. 
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Minority  Opinion.  Two  interviewees 
mentioned  the  increasing  need  for  software  system  safety. 
As  more  and  more  systems  are  controlled  by  computer 
software,  it  becomes  more  and  more  important  to  ensure 
that  the  software  cannot  cause  inadvertent  actions 
resulting  in  mishaps.  Another  individual  claims 
technology  is  advancing  faster  than  system  safety's 
ability  to  analyze  it. 

Armament  Division  —  Program  Management  Personnel. 

Question  One .  What  is  your  current  duty  title? 
Three  of  the  interviewees  were  engineers.  The  other  two 
were  program  managers . 

Question  Two .  What  acquisition  programs  are  you 
responsible  for?  Three  of  the  five  respondents  work  on 
only  one  program.  The  other  two  are  responsible  for  more 
than  one  program. 

Question  Three .  How  familiar  are  you  with  the 
discipline  of  system  safety?  All  five  people  interviewed 
were  aware  of  system  safety,  but  none  felt  they  were  very 
familiar  with  its  specific  requirements. 

Question  Four.  Do  you  know  who  has  system 
safety  responsibility  for  your  programs?  All  five 
respondents  knew  who  had  system  safety  responsibility  for 
their  programs. 

Question  Five .  How  do  you  view  the  discipline 
of  system  safety? 
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Majority  Opinion.  Four  of  the  five 


interviewees  stated  that  system  safety  was  an  integral 
part  of  the  acquisition  process.  Two  stated  that  the 
value  of  system  safety  depends  greatly  on  the  weapon 
system  itself.  The  more  complex  the  system,  the  more 
valuable  system  safety  becomes. 

Minority  Opinion.  One  respondent  considers 
system  safety  to  be  merely  another  requirement  to  be  added 
to  a  program.  Another  individual  thinks  system  safety 
should  be  integrated  with  the  engineering  community  in 
order  to  better  perform  their  duties. 

Question  Six.  Does  system  safety  contribute  to 
your  programs? 

Majority  Opinion.  Three  of  the  five 
interviewees  were  very  positive  in  their  comments  on 
system  safety's  contributions  to  their  programs. 

Minority  Opinion.  Two  individuals  stated 
that  at  times  system  safety  adds  requirements  to  programs 
that  aren't  necessary.  They  said  that  adhering  to  all  of 
the  requirements  of  a  system  safety  program  is  sometimes 
just  not  feasible.  Another  stated  that  system  safety  does 
not  contribute  to  his  program  at  all. 

Question  Seven.  Is  system  safety  cost- 

effective? 

Majority  Opinion.  Three  of  the  five 
respondents  consider  system  safety  to  be  cost-effective. 
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Two  mentioned  that  if  system  safety  saves  just  one  life, 
it  more  than  makes  up  for  any  and  all  costs  associated 
with  it. 

Minority  Opinion.  Two  individuals  consider 
system  safety  to  be  cost-effective,  but  not  efficient. 

They  state  that  in  many  instances  some  system  safety 
requirements  are  unnecessary  and  a  waste  of  money.  One 
other  considers  all  system  safety  to  be  a  waste  because 
engineering  covers  the  safety  aspect. 

Question  Eight .  How  could  system  safety  be 
improved  to  enhance  its  value  to  your  programs? 

Majority  Opinion.  Two  respondents  think 
that  system  safety  would  benefit  from  having  more 
personnel.  The  increasing  complexity  of  weapon  systems 
has  increased  the  need  for  more  system  safety,  but  there 
hasn't  been  an  increase  in  manpower. 

Minority  Opinion.  Two  respondents  didn't 
have  any  ideas  on  how  to  improve  system  safety.  Another 
suggested  that  system  safety  should  be  integrated  with 
engineering.  This  would  increase  their  visibility  and 
effectiveness . 

Question  Nine.  Have  you  received  and  guidance 
from  higher  headquarters  concerning  system  safety?  None 
of  the  interviewees  have  seen  any  correspondance 
concerning  system  safety. 
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Space  Division 


System  Safety  Personnel . 


Question  One .  What  is  your  current  duty  title? 
All  six  of  the  people  interviewed  include  system  safety  in 
their  duty  titles.  Only  one  included  the  term  engineer. 

Question  Two .  What  is  your  educational 
background?  Four  of  the  interviewees  have  bachelor's 
degrees  in  engineering.  Two  have  advanced  degrees  in 
engineering,  one  also  holds  a  Ph.D. 

Question  Three .  How  much  experience  do  you  have 
in  system  safety?  Five  of  the  six  interviewees  have  less 
that  five  year3  of  experience.  One,  however,  has  been  in 
system  safety  since  its  inception,  some  twenty-eight 
years . 

Question  Four.  What  system  safety  training  have 
you  had?  Five  of  the  six  respondents  have  attended  the 
system  safety  manager  course  taught  by  the  University  of 
Washington.  All  six  have  attended  a  local  SD  training 
course . 

Question  Five .  What  programs  do  you  currently 
have  system  safety  responsibility  for?  Because  of  the 
function  of  a  staff  office,  all  six  persons  interviewed 
are  responsible  for  more  than  one  program. 

Question  Six .  What  office  is  your  reporting 
official  located  in?  All  the  individuals  reported  to 
others  within  the  Directorate  of  Safety. 
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Question  Seven.  How  would  you  describe  your 


working  relationship  with  the  program  office  personnel  you 
work  with? 

Majority  Opinion.  Four  of  the  six  people 
interviewed  stated  that  their  working  relationship  with 
SPO  personnel  is  pretty  good.  They  all  mentioned  that 
support  varies  greatly  from  program  to  program.  Some 
program  managers  are  very  receptive  to  the  system  safety 
managers,  while  others  tend  to  ignore  them  completely. 

Minority  Opinion .  Two  of  the  respondents 
stated  that  their  relationship  with  the  SPO  personnel  is 
not  very  good.  Safety  tends  to  be  a  very  low  priority. 
Both,  however,  state  that  things  are  improving  immensely 
and  the  SPOs  are  placing  more  emphasis  on  system  safety. 

Question  Eight.  What  are  your  views  on  the 
impact  your  system  safety  program  has  on  your  acquisition 
programs? 

Majority  Opinion.  All  six  respondents 
believe  they  are  having  a  good  impact  on  acquisition 
programs.  Two  of  them  3tate  that  impact  varies  from 
program  to  program,  depending  on  the  support  of  the  SPOs. 

Minority  Opinion .  One  person  mentions  that 
at  times  SPOs  don't  pay  enough  attention  to  system  safety 
in  the  beginning  of  the  program.  When  it  becomes  time  to 
prepare  to  launch  the  system,  they  suddenly  become  system 
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safety  conscious.  This  late  action  results  in  many 
systems  needing  waivers  in  order  to  launch. 

Question  Nine .  What  trends  are  developing  in 
the  discipline  of  system  safety? 

Majority  Opinion.  Three  of  the  six  people 
interviewed  see  an  increasing  emphasis  on  system  safety. 
Two  of  them  credit  the  Challenger  disaster  for  the 
increase  in  emphasis. 

Minority  Opinion .  There  were  many 
interesting  trends  mentioned  by  individuals.  One 
respondent  brought  up  a  new  way  of  contracting.  The  Air 
Force  is  paying  a  contractor  only  for  "successful 
launches."  He  says  this  will  increase  the  emphasis  on 
system  safety  at  the  contractor's  facility  because  the 
contractor  can't  afford  to  miss  launches  or  lose  a  launch 
vehicle  without  reimbursement.  Another  stated  that  the 
emphasis  in  the  future  is  going  to  be  on  in-orbit  safety. 
There  are  many  different  things  in  orbit  now  and  the 
increasing  amounts  of  satellites  and  space  debris  is 
really  complicating  matters.  Another  trend  identified  is 
the . fact  that  now  most  DOD  payloads  are  now  launched  from 
expendable  launch  vehicles  rather  than  the  space  shuttle. 

Space  Division  —  Program  Management  Personnel . 

Question  One .  What  is  your  current  duty  title? 
Four  of  the  six  interviewees  were  program  management 
individuals.  The  other  two  were  engineers. 
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Question  Two .  What  acquisition  programs  are  you 
responsible  for?  Three  of  the  respondents  worked  on  only 
one  program.  The  other  three  worked  on  more  than  one 
program . 

Question  Three .  How  familiar  are  you  with  the 
discipline  of  system  safety?  Five  of  the  six  interviewees 
state  that  they  are  somewhat  familiar  with  system  safety. 
The  other  one  stated  that  he  is  very  familiar  with  the 
discipline. 

Question  Four .  Do  you  know  who  has  system 
safety  responsibility  for  your  programs?  All  six  are 
aware  of  who  their  system  safety  representative  is. 

Question  Five .  How  do  you  view  the  discipline 
of  system  safety? 

Majority  Opinion.  Five  of  the  six  people 
interviewed  look  at  system  safety  as  being  a  very 
important  part  of  the  acquisition  process.  Two  of  the 
five  think  that  it  needs  even  more  emphasis  than  it  is 
currently  getting.  Another  stressed  that  system  safety 
representatives  need  to  use  more  common  sense  and  not  just 
add  all  requirements  to  all  programs. 

Minority  Opinion.  The  other  respondent 
didn't  think  that  system  safety  applies  to  his  program  and 
didn't  offer  an  opinion  on  the  discipline. 

Question  Six.  Does  system  safety  contribute  to 
your  programs? 
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Majority  Opinion.  Five  interviewees  feel 
strongly  that  system  safety  is  a  valuable  contributor  to 
their  programs. 

Minority  Opinion.  The  remaining  respondent 
said  that  system  safety  only  occasionally  contributes  to 
his  program  and  right  now  it  is  not  contributing. 

Question  Seven .  Is  system  safety  cost- 

effective? 

Majority  Opinion .  Five  of  the  six 
interviewees  stated  that  system  safety  is  cost-effective. 
Two  of  the  five  stress  that  when  system  safety  is 
incorporated  very  early  in  the  acquisition  process,  the 
cost-effectiveness  rises  dramatically.  This  is  because 
the  later  design  changes  are  made,  the  more  money  they 
cost . 

Minority  Opinion.  One  respondent  stated 
that  system  safety  representatives  just  "stick 
requirements  in  contracts  without  knowing  the  program." 
This  results  in  unnecessary  costs  making  system  safety  not 
cost-effective . 

Question  Eight .  How  could  system  safety  be 
improved  to  enhance  its  value  to  your  programs? 

Majority  Opinion.  Three  of  the  six  think 
that  system  safety  personnel  need  to  get  more  involved 
with  the  programs.  By  doing  this,  tailoring  system  safety 
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requirements  to  each  program  would  be  easier.  This  would 
result  in  fewer  unnecessary  costs. 


Minority  Opinion .  One  respondent  thinks 
that  training  contractors  on  the  contents  of  MIL-STD-882B 
would  enhance  the  value  of  system  safety.  Two  others  had 
no  suggestions  for  improvement. 

Question  Nine.  Have  you  received  any  guidance 
from  higher  headquarters  concerning  system  safety?  Two 
interviewees  recall  seeing  a  letter  from  SD/CC  directing 
an  independent  assessment  for  safety  inspections  be  done 
on  certain  programs  before  operation.  This  came  after  the 
space  shuttle  disaster.  The  other  four  respondents  don't 
remember  any  kind  of  correspondence  concerning  system 
safety. 

Aeronautical  Systems  Division  —  System  Safety 
Personnel . 

Question  One .  What  is  your  current  duty  title? 
Eighteen  of  twenty-one  people  interviewed  termed 
themselves  as  system  safety  managers.  Three  stated  they 
were  system  safety  engineers. 

Question  Two .  What  is  your  educational 
background?  Thirteen  of  the  twenty-one  interviewees  have 
undergraduate  degrees  in  some  kind  of  engineering.  Eleven 
of  the  twenty-one  have  master's  degrees.  Only  one  has  a 
master's  degree  in  engineering. 


Question  Three.  How  much  experience  do  you  have 
in  system  safety?  Seven  of  the  twenty-one  respondents 
have  five  years  experience  or  more.  The  mean  years  of 
experience  is  4.4  years. 

Question  Four .  What  system  safety  training  have 
you  had?  All  but  one  of  the  people  interviewed  have 
attended  the  system  safety  manager  course  now  offered  by 
the  University  of  Washington.  Fifteen  have  also  attended 
the  fault  tree  analysis  course  also  taught  at  the 
University  of  Washington.  Only  one  of  the  twenty-one 
respondents  has  not  received  any  formal  system  safety 
training. 

Question  Five.  What  programs  do  you  currently 
have  system  safety  responsibility  for?  Twelve  of  the 
twenty-one  interviewees  work  on  only  one  major  weapon 
system.  The  remaining  nine  have  responsibility  for  more 
than  one  weapon  system.  However,  most  major  weapon 
systems  have  many  projects  related  to  their  development. 

Question  Six.  What  office  is  your  reporting 
official  located  in?  Eight  of  the  nine  three-letter 
safety  directors  interviewed  report  directly  to  the  two- 
letter  directors.  The  one  exception  reports  to  a  three- 
letter.  The  remaining  twelve  interviewees  report  to 
either  the  three-letter  safety  directors,  or  the  Chief  of 
ASD  Safety. 
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luestion  Seven.  How  would  you  describe  your 


working  relationship  with  the  program  office  personnel  you 
work  with? 

Majority  Opinion.  Eighteen  of  the  twenty- 
one  people  interviewed  stated  their  relationships  with  the 
SPO  personnel  are  pretty  good  to  excellent.  However,  ten 
of  the  eighteen  said  that  their  relationships  do  have 
instances  when  they  have  some  problems  getting  SPO 
personnel  to  listen  to  them  and  keep  them  informed  on 
program  developments. 

Minority  Opinion.  Three  of  the  twenty-one 
stated  that  they  have  trouble  communicating  with  the 
program  managers.  They  believe  that  system  safety  has  a 
very  low  priority  and  program  managers  tend  to  ignore 
them. 

Question  Eight .  What  are  your  views  on  the 
impact  your  system  safety  program  has  on  your  acquisition 
programs? 

Majority  Opinion.  Sixteen  of  the  twenty- 
one  interviewees  said  that  they  were  having  a  good  impact 
on  acquisition  programs.  Three  of  the  sixteen  mentioned 
that  they  have  had  "success  stories,"  instances  when  they 
actually  caused  changes  in  design  to  be  made.  One  stated 
that  the  SPO  director,  a  brigadier  general,  was  system 
safety's  biggest  supporter. 


Minority  Opinion.  Five  of  the  respondents 
believe  that  they  were  having  little  impact  on  their 
acquisition  programs.  One  stated  that  the  little  impact 
he  is  having  is  diminishing  because  safety  is  the  first 
thing  to  be  cut  in  times  of  budget  cuts.  Three  of  the 
five  claim  that  system  safety  has  a  "bad  name."  This 
results  in  the  system  safety  personnel  fighting  to  get 
attention  and  trying  to  justify  their  requirements.  One 
respondent  went  so  far  as  to  suggest  that  system  safety 
may  not  even  be  necessary. 

Question  Nine .  What  trends  are  developing  in 
the  discipline  of  system  safety? 

Majority  Opinion.  Three  major  trends  were 
identified.  Seven  interviewees  expressed  concern  over  the 
issue  of  software  system  safety.  The  need  is  growing,  but 
the  ability  to  do  software  system  safety  is  still 
developing.  Seven  respondents  also  stated  that  there  is  a 
trend  towards  system  safety  emphasizing  the  management 
aspects  more  than  developing  the  technical  expertise  to 
perform  system  safety  engineering.  Six  of  the  people 
interviewed  cited  an  increasing  shortage  of  manpower. 

Four  of  these  people  specifically  mentioned  the  loss  of 
pilots.  One  reason  for  this  is  the  recent  change  in  the 
certification  process  for  the  27XX  career  field.  This 
makes  it  very  difficult  for  rated  supplement  positions. 
This  results  in  a  loss  of  operational  expertise. 


Minority  Opinion.  Three  of  the  twenty-one 
interviewees  did  not  identify  any  trends.  Two  respondents 
mentioned  a  swing  toward  accountability.  They  believe  the 
new  AFSC  Form  180,  as  required  by  the  new  AFSC  Supplement 
to  AFR  800-16,  is  a  way  to  force  the  program  managers  to 
accept  residual  risk  associated  with  their  systems.  This 
also  removes  responsibility  from  the  system  safety 
representative.  One  other  respondent  stated  that  there  is 
an  increasing  emphasis  on  performance  of  weapon  systems. 
This  results  in  shortcuts  being  taken  which,  in  turn, 
increases  risk.  One  other  respondent  simply  stated  that 
there  is  diminishing  respect  for  system  safety. 

Aeronautical  Systems  Division  —  Program  Management 
Personnel . 

Question  One.  What  is  your  current  duty  title? 
Eleven  of  the  people  interviewed  are  engineers.  The  other 
ten  are  program  management  individuals. 

Question  Two .  What  acquisition  programs  are  you 
responsible  for?  Sixteen  of  the  twenty-one  people 
interviewed  work  on  only  one  program.  The  remaining  five 
have  multiple  responsibilities. 

Question  Three.  How  familiar  are  you  with  the 


discipline  of  system  safety?  Eleven  of  the  twenty-one 
interviewees  stated  they  were  not  very  familiar  with 
system  safety.  Eight  respondents  said  they  were  somewhat 


familiar  with  the  discipline.  The  remaining  two  believe 
they  are  very  familiar  with  system  safety. 

Question  Four .  Do  you  know  who  has  system 
safety  responsibility  for  your  programs?  Only  one 
respondent  did  not  know  who  had  system  safety 
responsibility  for  his  program.  The  remaining  twenty  knew 
their  system  safety  representative. 

Question  Five .  How  do  you  view  the  discipline 
of  system  safety? 

Majority  Opinion .  Eighteen  of  the  twenty- 
one  people  interviewed  term  system  safety  as  important  or 
very  important.  Four  of  these  respondents,  however, 
qualified  their  answers.  Two  of  them  stated  that  many 
times  system  safety  adds  requirements  that  are  unnecessary 
and  a  waste  of  time  and  money.  Two  others  believe  that 
the  discipline  itself  is  disorganized  and  difficult  to 
understand. 

Minority  Opinion.  Three  of  the  twenty-one 
interviewees  don't  think  that  system  safety  is  very 
important.  One  termed  system  safety  as  a  "watchdog 
agency"  that  merely  duplicates  engineering  work. 

Question  Six.  Does  system  safety  contribute  to 
your  programs? 

Majority  Opinion.  Of  the  twenty-one  people 
interviewed,  eighteen  said  that  system  safety  does 
contribute  to  their  programs.  Two  of  the  eighteen  did 
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state,  however,  that  sometimes  system  safety 
representatives  add  unnecessary  requirements.  This 
reduces  its  effectiveness. 

Minority  Opinion.  Three  respondents  don't 
think  system  safety  is  contributing  to  their  programs. 

Two  view  system  safety  only  as  a  square-filler.  The  third 
respondent  stated  that  while  system  safety  is  currently 
not  contributing  to  his  program,  he  would  not  be  without 
it . 

Question  Seven.  Is  system  safety  cost- 

effective? 

Majority  Opinion.  Fifteen  of  the  twenty- 
one  interviewees  consider  system  safety  to  be  cost- 
effective.  Three  said  lives  are  more  valuable  than  any 
costs  associated  with  system  safety.  One  other  stated 
that  while  he  thinks  system  safety  is  cost-effective,  it 
isn't  efficient  because  many  of  the  costs  are  not 
necessary.  Another  stressed  that  the  earlier  system 
safety  is  incorporated  in  a  program,  the  more  cost- 
effective  it  is  because  of  the  increasing  cost  of  changing 
designs. 

Minority  Opinion.  One  respondent  doesn't 
think  system  safety  is  cost-effective.  Two  interviewees 
say  that  because  of  the  difficulty  in  measuring  the 
effectiveness  of  system  safety,  its  cost-effectiveness 
can't  be  measured.  Two  other  respondents  said  that 
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because  of  the  nature  of  their  programs,  they  can't  see 
how  much  money  is  being  spent  on  system  safety.  The  last 
interviewee  thinks  that  it  would  probably  be  cheaper  to 
ignore  system  safety. 

Question  Eight .  How  could  system  safety  be 
improved  to  enhance  its  value  to  your  programs? 

Majority  Opinion. -  Two  major  areas  of 
possible  improvement  for  system  safety  were  suggested. 

Four  respondents  said  that  system  safety  needs  more 
manpower  to  be  effective.  They  are  spread  too  thin  to  be 
as  effective  as  possible.  Four  other  respondents  believe 
that  system  safety  needs  some  kind  of  computerized  data 
base  of  lessons  learned.  This  would  help  prevent  the  same 
design  mistakes  from  being  repeated. 

Minority  Opinion.  Six  respondents  had  no 
ideas  on  improving  system  safety.  Three  of  the  twenty-one 
interviewees  stated  that  system  safety  would  be  more 
effective  if  it  was  incorporated  into  the  engineering 
function.  This  would  reduce  duplication  of  effort  and 
present  a  united  front.  Two  interviewees  said  that  system 
safety  needs  more  authority.  Their  rank  structure  isn't 
enough  to  be  taken  seriously.  One  respondent  thinks  the 
system  safety  discipline  needs  more  structure.  He 
suggests  they  adopt  some  sort  of  checklist  approach  to 
identifying  hazards.  Another  states  simply  that  the 
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system  safety  personnel  need  to  get  more  involved  and  get 
to  know  the  weapon  systems  better. 

Question  Nine .  Have  you  received  any  guidance 
from  higher  headquarters  concerning  system  safety? 

Nineteen  of  the  twenty-one  people  interviewed  have  not 
seen  any  kind  of  correspondence  from  higher  headquarters 
concerning  system  safety.  One  respondent  stated  he  saw 
some  kind  of  policy  letter  on  safety  a  few  years  ago. 
Another  stated  that  his  new  program  director  issued  a 
letter  emphasizing  system  safety  as  3oon  a3  he  arrived. 

Overal 1  Results  —  System  Safety  Personnel . 

Question  One .  What  is  your  current  duty  title? 
Twenty-five  of  the  thirty-five  system  safety  personnel 
interviewed  consider  themselves  system  safety  managers. 
Eight  are  system  safety  engineers,  and  two  use  only 
"safety"  in  their  duty  titles. 

Question  Two .  What  is  your  educational 
background?  Twenty-four  of  the  thirty-five  interviewees 
have  undergraduate  engineering  degrees.  Nineteen  have 
master's  degrees,  one  has  a  Ph.D. 

Question  Three .  How  much  experience  do  you  have 
in  system  safety?  Six  of  the  thirty-five  interviewees 
have  more  than  ten  years  of  experience  in  system  safety. 
The  mean  level  of  experience  is  6.2  years. 

Question  Four.  What  system  safety  training  have 
you  had?  Thirty-three  of  the  thirty-five  people 


interviewed  have  attended  the  system  safety  manager  course 
taught  by  the  University  of  Washington.  Twenty  have  also 
attended  the  fault  tree  analysis  course  offered  by  the 
same  school.  Only  two  out  of  the  thirty-five  have  not 
received  any  formal  system  safety  training. 

Question  Five .  What  programs  do  you  currently 
have  system  safety  responsibility  for?  Twenty-three  of 
the  thirty-five  respondents  are  responsible  for  more  than 
one  program.  Twelve  work  on  only  one  major  weapon  system. 

Question  Six .  What  office  is  your  reporting 
official  located  in?  Sixteen  of  the  thirty-five  people 
interviewed  are  members  of  staff  offices.  Ten  of  the 
respondents  report  to  three-letter  system  safety 
directors.  Eight  of  nine  co-located  system  safety 
directors  report  to  the  two-letter  program  directors. 

Only  one  reports  to  the  three-letter  level . 

Question  Seven .  How  would  you  describe  your 
working  relationship  with  the  program  office  personnel  you 
work  with? 

Majority  Opinion ■  Twenty-six  of  the 
thirty-five  interviewees  said  they  have  good  or  excellent 
working  relationships  with  SPO  personnel.  Fourteen  of 
these  admit  that  the  relationships  vary  from  person  to 
person.  Four  others  credit  their  value  as  corporate 
memory  to  the  SPOs  as  the  reason  for  the  favorable 
relationships . 


Minority  Opinion ■  Nine  of  the  thirty-five 
respondents  stated  their  relationships  with  the  SPO 
personnel  were  not  very  good.  They  believe  they  are  a  low 
priority  to  the  SPOs .  Two  of  these,  however,  think  their 
relationships  are  improving. 

Question  Eight .  What  are  your  views  on  the 
impact  your  system  safety  program  has  on  your  acquisition 
programs? 

Majority  Opinion.  Of  the  thirty-five 
system  safety  personnel  interviewed,  twenty-nine  of  them 
stated  that  they  are  having  a  good  impact  on  their 
acquisition  programs.  Three  still  think  they  are  somewhat 
restricted  because  of  the  negative  attitude  SPOs  have 
against  system  safety.  Two  others  said  they  are  having  an 
overall  good  impact  but  that  the  affects  vary  from  program 
to  program. 

Minority  Opinion .  Six  of  the  thirty-five 
interviewees  said  they  are  having  little  impact  on  their 
programs.  Three  stated  that  system  safety  has  a  "bad 
name"  and  that  many  of  their  efforts  are  ignored.  One 
respondent  thinks  the  emphasis  on  system  safety  is 
diminishing.  Another  claims  it  takes  a  catastrophe  .to 
shift  attention  to  system  safety. 

Question  Nine .  What  trends  are  developing  in 
the  discipline  of  system  safety? 
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Majority  Opinion.  Eight  of  the  thirty-five 
respondents  think  there  is  an  increasing  emphasis  on 
system  safety.  Four  of  these  credit  the  Challenger 
disaster  for  this  trend.  Eight  others  stated  there  is  an 
ever-increasing  need  for  software  system  safety  as  weapon 
systems  become  more  complex.  Six  respondents  see  an 
increased  emphasis  on  the  management  aspects  of  system 
safety,  away  from  the  technical,  analytical  aspects.  Five 
others  said  decreasing  manpower  is  the  current  major  trend 
in  system  safety. 

Minority  Opinion.  Three  of  the  thirty-five 
interviewees  did  not  identify  any  trends.  Three 
respondents  think  the  future  will  bring  more  streamlined 
system  safety  programs  because  of  the  emphasis  on  reducing 
costs.  Two  others  think  technology  is  advancing  so 
rapidly  that  system  safety  is  lagging  behind  in  its 
ability  to  perform  hazard  analysis  on  it.  Two 
interviewees  view  the  new  AFSC  Form  180  as  an  emphasis  on 
accountability  and  getting  the  program  managers  more 
involved  in  system  safety.  Finally,  two  other 
interviewees  see  an  increasing  emphasis  on  the  performance 
of  weapon  systems.  One  sees  this  as  creating  more 
emphasis  on  system  safety  at  the  contractor's  program 
office,  while  the  other  thinks  it  may  cause  shortcuts  to 
be  taken,  decreasing  overall  system  safety. 


Overall  Results 


Program  Management  Personnel. 


Question  One .  What  is  your  current  duty  title? 
Eighteen  of  the  thirty-five  people  interviewed  are  program 
managers.  The  other  seventeen  are  engineers. 

Question  Two .  What  acquisition  programs  are  you 
responsible  for?  Twenty-five  of  the  thirty-five 
interviewees  are  only  responsible  for  one  program.  The 
remaining  ten  work  on  more  than  one  program. 

Question  Three.  How  familiar  are  you  with  the 
discipline  of  system  safety?  Of  the  thirty-five  people 
interviewed,  nineteen  stated  they  are  not  very  familiar 
with  system  safety.  Thirteen  said  they  are  somewhat 
familiar  with  the  discipline.  The  remaining  three  said 
they  are  very  familiar  with  system  safety. 

Question  Four.  Do  you  know  who  has  system 
safety  responsibility  for  your  programs?  Only  two  of  the 
thirty-five  people  interviewed  did  not  know  who  their 
system  safety  representative  is. 

Question  Five .  How  do  you  view  the  discipline 
of  system  safety? 

Majority  Opinion .  Thirty  of  the  thirty- 
five  interviewees  consider  system  safety  to  be  an 
important  part  of  an  acquisition  program.  Three  of  these 
said  its  importance  varies  according  to  a  system's  value 
and  complexity.  The  higher  the  value  and  complexity,  the 
more  important  system  safety  becomes,  and  vice  versa. 


Three  of  these  thirty  also  believe  that,  at  times, 
unnecessary  system  safety  requirements  are  added  to 
contracts.  Two  others  said  that  there  needs  to  be  a 
greater  emphasis  on  system  safety. 

Minority  Opinion ■  Only  four  of  the  thirty- 
five  interviewees  do  not  think  system  safety  is  an 
important  part  of  an  acquisition  program.  One  interviewee 
did  not  offer  an  opinion. 

Question  Six ■  Does  system  safety  contribute  to 
your  programs? 

Majority  Opinion.  Twenty-nine  of  the 
thirty-five  respondents  stated  that  system  safety 
contributes  to  their  programs.  Four  of  these,  however, 
said  that  system  safety  does  sometimes  add  unnecessary 
requirements  to  contracts  which  hinder  its  overall 
contribution  to  a  program. 

Minority  Opinion.  Six  respondents  do  not 
think  system  safety  contributes  to  their  acquisition 
programs.  Two  consider  system  safety  to  be  merely  a 
"square-filler."  One  other  stated  that  while  system 
safety  is  currently  not  contributing  to  his  program,  he 
would  not  be  without  it.  The  remaining  individual  was 
completely  ambivalent  towards  system  safety. 

Question  Seven.  Is  system  safety  cost- 

effective? 
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Majority  Opinion.  Of  the  thirty-five 
people  interviewed,  twenty-seven  think  system  safety  is 
cost-effective.  Five  of  these  stress  the  need  to  tailor 
system  safety  requirements  to  each  program  to  eliminate 
unnecessary  costs,  thereby  raising  cost-effectiveness. 

Five  others  stated  that  if  the  incorporation  of  system 
safety  saves  just  one  life,  it  is  cost-effective.  Four  of 
the  twenty-seven  emphasize  the  early  incorporation  of 
system  safety  because  it's  cheaper  to  change  paper-  than 
metal . 

Minority  Opinion.  Four  of  the  thirty-five 
respondents  do  not  think  system  safety  is  cost-effective. 
Four  others  don't  know  if  it's  cost-effective.  Two  of 
these  can't  see  the  money  spent  on  system  safety  because 
of  the  program  structure,  and  the  other  two  said  that  the 
benefits  of  system  safety  can't  really  be  measured,  making 
it  impossible  to  determine  cost-effectiveness. 

Question  Eight .  How  could  system  safety  be 
changed  to  enhance  its  value  to  your  programs? 

Majority  Opinion.  Six  of  the  thirty-five 
interviewees  think  system  safety  needs  more  manpower  to 
effectively  do  their  job.  In  a  related  vein,  four 
respondents  stressed  that  system  safety  representatives 
need  to  get  more  involved  with  the  acquisition  programs. 
This  would  be  easier  if  there  were  more  system  safety 
personnel.  Four  other  respondents  said  that  system  safety 
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would  be  more  effective  if  it  was  incorporated  into  the 
engineering  structure.  Another  four  respondents  suggested 
the  development  of  a  computerized  data  base  of  lessons 
learned  to  prevent  earlier  design  inadequacies  from  being 
repeated . 

Minority  Opinion .  Eleven  respondents  had 
no  suggestions  on  improving  system  safety.  Two  of  the 
thirty-five  interviewees  said  system  safety's  rank 
structure  doesn't  provide  them  with  enough  authority  to  be 
truly  effective.  Another  stressed  earlier  involvement  in 
the  acquisition  process.  One  individual  said  that  the 
system  safety  organization  needs  more  structure.  Another 
thinks  training  contractors  on  the  requirements  of  MIL- 
STD-882B  would  be  beneficial.  Finally,  one  individual 
specifically  wants  an  alternative  to  halon  fire 
suppression  systems  to  increase  supportabi 1 ity . 

Question  Nine.  Have  you  received  any  guidance 
from  higher  headquarters  concerning  system  safety?  Only 
five  of  the  thirty-five  interviewees  recall  ever  seeing 
correspondence  from  higher  headquarters  concerning  system 
safety.  Thirty  said  they  have  never  seen  such 
correspondence . 

Other  Significant  Findings 

Because  of  the  nature  of  the  open-ended  question  used 
in  the  interviews,  the  researcher  received  many  comments 
that  really  didn't  pertain  directly  to  the  questions. 
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Some  of  the  more  significant  comments  included  information 
about  the  Challenger  disaster,  career  progression  in 
system  safety,  and  system  safety  training. 

Impact  of  the  Challenger  Disaster .  There  were 
varying  opinions  on  how  the  explosion  of  the  space  shuttle 
affected  the  image  of  system  safety.  Six  people  think 
that  the  incident  caused  an  increased  emphasis  on 
performing  system  safety  during  the  acquisition  process. 
Four  others  mentioned  that  they  didn't  think  the 
Challenger  had  any  impact  at  all  on  system  safety 
emphasis.  Two  of  them,  however,  stated  that  after  the 
mishap  the  National  Aeronautics  and  Space  Administration 
(NASA)  hired  a  large  number  of  system  safety  personnel. 
This  resulted  in  many  individuals  leaving  the  military  and 
contractors  and  joining  NASA.  Perhaps  the  most 
interesting  information  came  from  Mr.  Roger  Lockwood,  a. 
co-founder  of  the  system  safety  discipline.  Using  NASA's 
hazard  probabilities,  he  published  a  paper  predicting  a 
catastrophic  mishap  on  the  shuttle's  twenty-fifth  launch. 
The  Challenger  disaster  occurred  on  the  twenty-fourth 
launch  ( 10) . 

Career  Progression.  While  four  of  the  program 
management  personnel  mentioned  that  system  safety  would 
benefit  by  having  additional  manpower,  four  system  safety 
personnel  stated  that  they  have  trouble  getting  personnel 
into  system  safety  because  there  is  no  room  for  career 
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advancement.  A  major  reason  military  shun  entering  the 
system  safety  field  is  the  historically  low  promotion 
rates.  Unfortunately,  no  actual  statistics  were  found. 

Training.  Two  of  the  program  management  personnel 
suggested  that  system  safety  should  be  addressed  in  the 
introductory  acquisition  classes  taught  at  each  product 
division.  This  would  at  least  promote  awareness.  On  the 
other  side  of  the  coin,  six  system  safety  personnel 
volunteered  that  the  required  system  safety  manager  course 
they  attended  was  almost  worthless.  They  believe  that  the 
instruction  received  had  little  to  do  with  what  their 
duties  actually  are. 

Now  that  the  data  has  been  presented,  some 
conclusions  and  recommendations  can  be  made. 
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VI .  Conclusions  and  Recommendations 

Introduction 

This  chapter  contains  the  conclusions  and 
recommendations  of  this  research  effort.  There  were  five 
objectives  to  the  research.  First,  it  attempted  to 
determine  the  origin  of  system  safety.  Second,  it  sought 
to  understand  the  discipline  itself.  The  third  objective 
was  to  explain  the  evolution  of  system  safety.  The  fourth 
objective  of  the  research  was  to  determine  the  current 
effectiveness  of  system  safety.  Finally,  the  research 
attempted  to  discover  what  the  future  holds  for  system 
safety.  A  summary  of  findings  will  be  related  to  the 
thirteen  research  questions  and  relevant  conclusions  will 
be  drawn.  In  addition,  this  final  chapter  will  include 
recommendations  for  improving  system  safety  and  suggested 
areas  for  further  study  and  research. 

Research  Questions 

The  first  eight  research  questions  were  answered 
through  documentation  search  and  informational  interviews 
with  system  safety  personnel.  The  detailed  results  of 
these  questions  are  contained  in  Chapters  III  and  IV. 

Question  la.  This  question  attempted  to  find  when 
and  on  what  program  system  safety  was  first  applied.  As 
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mentioned  in  Chapter  IV,  the  first  system  safety  program 
was  applied  on  the  Minuteman  Missile  Program  in  1962. 

Question  lb.  The  discipline  of  system  safety  was 
first  developed  by  the  Ballistic  Missile  Division  of  the 
Air  Force.  During  the  researcher's  interviews,  Mr.  Roger 
Lockwood,  one  of  the  founders  of  system  safety  was 
interviewed. 

Question  lc .  If  system  safety  was  developed  in  an 
organization  other  than  the  Air  Force,  the  researcher 
wanted  to  determine  when  the  Air  Force  adopted  the 
discipline.  Since  it  was  developed  in  the  Air  Force,  the 
question  became  unnecessary. 

Question  2a.  This  question  dealt  with  the  discipline 
itself.  It  attempted  to  determine  what  system  safety  is 
and  what  its  purpose  is  in  an  acquisition  program.  It  is 
a  process  by  which  hazards  are  identified  and  eliminated 
or  controlled  in  a  weapon  system.  Ideally,  this  takes 
place  during  system  design.  Chapter  III  contains  a  more 
detailed  discussion  of  system  safety. 

Question  2b.  This  question  sought  to  describe  how 
system  safety  is  applied  to  acquisition  programs.  As 
stated  above,  it  is  best  to  implement  a  system  safety 
program  as  early  as  possible  during  a  system's  life  cycle. 
In  AFSC,  system  safety  representatives  review  contractual 
documentation  to  ensure  system  safety  requirements  are 
met.  These  individuals  also  coordinate  on  program 
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documentation  to  assess  impact  on  the  safety  of  the 
system.  In  addition  to  this,  they  must  monitor 
contractor  tasks  to  ensure  quality  products.  While  the 
system  safety  representatives  are  the  focal  point  for 
system  safety  concerns,  the  program  manager  is  still 
responsible  for  accepting  any  risk  associated  with  the 
system. 

Question  3a.  This  question  served  to  see  how  the 
process  of  system  safety  has  evolved  through  the  years. 

It  began  by  being  applied  to  only  one  Air  Force  program. 

It  is  now  appicable  to  all  DOD  acquisition  programs 
including  the  purchase  of  off-the-shelf  equipment.  More 
details  are  contained  in  Chapter  IV. 

Question  3b.  To  see  how  the  DOD  and  Air  Force 
positions  on  system  safety  have  changed  through  the  years, 
the  researcher  looked  at  how  the  main  governing  documents 
have  changed  since  the  origin  of  system  safety. 
Responsibilities  have  expanded,  and  many  new  techniques 
have  been  introduced.  The  AFSC  Form  180  is  now  required 
by  the  AFSC  Supplement  to  AFR  800-16.  This  form  is  to  be 
filled  out  for  every  hazard  identified  in  a  system.  The 
program  manager  then  signs  each  form  to  accept  the 
residual  risk  associated  with  each  hazard.  This  appears 
to  the  researcher  to  be  a  tool  to  relieve  the  system 
safety  community  from  any  responsibility  should  a  hazard 
cause  a  mishap  in  the  future.  Admittedly,  the  program 
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manager  has  always  had  final  responsibility  for  a  fielded 
system.  However,  it  does  give  the  appearance  of 
protecting  the  system  safety  representative.  On  the  other 
hand,  the  AFSC  Form  180  will  also  force  the  program 
manager  to  get  involved  with  the  system  safety  program. 

It  ensures  that  the  program  manager  knows  all  the  hazards 
in  the  system.  If  the  program  manager  does  not  want  to 
accept  the  risk  associated  with  a  hazard,  he  can  get 
involved  with  the  system  safety  manager  to  eliminate  or 
control  the  risk  to  an  acceptable  level. 

Question  3c.  This  question  was  designed  to  see  what 
system  safety  can  do  for  an  acquisition  program.  An 
effective  system  safety  program  can  conserve  both 
equipment  and  human  resources  by  preventing  mishaps.  It 
can  also  increase  combat  capability.  By  changing  designs 
before  systems  are  operational,  downtime  due  to  retrofits 
will  be  decreeased.  System  safety  can  also  save  systems 
from  being  destroyed  due  to  catastrophic  mishaps.  This 
keeps  more  systems  operational.  Two  actual  examples  of 
the  benefits  of  system  safety  are  provided  in  Chapter  III. 

Question  4a.  This  question  was  designed  to  determine 
how  program  management  personnel  view  system  safety.  Six 
interview  questions  were  used  to  help  find  the  answer: 
question  seven  on  the  system  safety  personnel  interview, 
and  questions  three,  four,  five,  six,  and  seven  on  the 
program  management  personnel  interview.  Based  on  the 
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responses  to  these  questions,  it  is  evident  that  program 
management  personnel  value  the  contributions  that  system 
safety  makes  to  their  programs.  Almost  three-fourths  of 
the  system  safety  personnel  interviewed  stated  that  they 
had  good  to  excellent  working  relationships  with  the  SP Os. 
Over  eighty-five  percent  of  the  program  management 
personnel  interviewed  consider  system  safety  to  be  an 
important  part  of  an  acquisition  program.  Only  two  of  the 
thirty-five  SPO  personnel  interviewed  do  not  know  who 
their  system  safety  representative  is.  It  is  acknowledged 
that  some  program  personnel  don't  think  that  system  safety 
is  worthwhile.  There  are  two  reasons  that  may  explain 
this  without  reflecting  badly  on  the  discipline:  1)  the 
respondent ' s  program  may  be  such  that  the  impact  of  system 
safety  is  minimal  (i.e.,  small  program,  little 
development),  and  2)  the  system  safety  representative  may 
be  negligent  in  his  duties  or  have  personality  conflicts 
with  the  SPO  personnel.  Dissenting  opinions  aside,  the 
vast  majority  of  program  management  personnel  interviewed 
consider  system  safety  to  be  a  valuable  contributor  to 
their  programs.  The  challenge  is  to  overcome  the  negative 
attitudes  toward  system  safety. 

Question  4b.  This  question  was  designed  to  determine 
the  attitude  of  system  safety  personnel  as  to  their 
perceived  worth  to  their  acquisition  programs.  Based  on 
the  responses  received  to  question  eight  of  the  system 
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safety  personnel  interview,  system  safety  managers 
consider  themselves  to  be  valuable  contributors  to  their 
respective  acquisition  programs.  Over  eighty-twc  percent 
of  the  system  safety  personnel  interviewed  consider  their 
efforts  are  having  a  positive  impact  on  their  programs. 
This  may  also  impact  job  satisfaction,  though  that  area  is 
beyond  the  scope  of  this  thesis. 

Question  4c.  This  question  was  designed  to  see  if 
the  program  management  personnel  are  receiving  system 
safety  support  from  personnel  that  know  their 
responsibilities  and  have  expertise  to  carry  them  out. 
Questions  two,  three,  and  four  were  used  to  answer  this 
question.  Almost  seventy  percent  of  the  system  safety 
personnel  interviewed  have  engineering  degrees.  Over  half 
have  advanced  degrees.  The  system  safety  manager  course, 
now  offered  by  the  University  of  Washington,  has  been 
attended  by  over  ninety-four  percent  of  the  respondents, 
with  fifty-seven  percent  having  attended  the  fault  tree 
analysis  course  at  the  same  school.  The  average 
experience  level  of  the  thirty-five  system  safety 
personnel  interviewed  was  6.2  years.  Based  on  these 
facts,  it  is  apparent  that  system  safety  personnel  are 
both  qualified  and  able  to  perform  their  jobs. 

Question  5a.  The  purpose  of  this  question  was  to 
determine  if  system  safety  has  become  stagnant  or  if  it  is 
still  a  dynamic  field.  The  responses  to  question  nine  of 
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the  system  safety  personnel  interview  and  question  eight 
of  the  program  management  personnel  interview  indicate 
that  system  safety  still  has  plenty  of  developing  to  do  in 
the  future.  Twenty-two  percent  of  the  system  safety 
representatives  interviewed  think  the  emphasis  on  system 
safety  is  increasing.  This  in  itself  will  ensure  that 
system  safety  keeps  on  developing.  The  fact  that  only 
five  of  the  thirty-five  program  management  personnel 
interviewed  have  seen  correspondence  from  higher 
headquarters  concerning  system  safety  does  not  corroborate 
this,  however.  If  system  safety  is  to  become  more 
important,  it  must  receive  more  support  from  the  higher 
levels  of  management.  The  new  AFSC  Form  180  is  a  new 
development  that  is  just  beginning  to  take  effect.  The 
increasing  technology  will  necessitate  new,  advanced  types 
of  hazard  analysis  techniques.  The  conclusion  arrived  at 
is  that  not  only  is  system  safety  still  developing,  it  may 
still  be  in  its  infancy. 

Question  5b.  This  question  sought  to  determine  what 
trends  are  being  perceived  in  the  system  safety 
discipline.  Question  nine  of  the  system  safety  personnel 
interview  and  questions  eight  and  nine  of  the  program 
management  personnel  interview  were  used  to  answer  this 
question.  The  issue  of  software  system  safety  was  raised 
by  twenty-two  percent  of  the  system  safety 
representatives.  There  is  an  increasing  number  of 
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software-driven  hardware  that  requires  some  kind  of  hazard 
analysis  be  done.  MIL-STD-882B  has  a  task  for  software 
hazard  analysis,  but  there  is  a  question  as  to  how  exactly 
to  perforin  it.  The  System  Safety  Office  at  Armament 
Division  has  developed  their  own  software  hazard  analysis 
technique,  however,  it  is  extremely  manpower  intensive 
and  is  currently  limited  in  its  application.  This  area  is 
definitely  one  of  concern.  The  Aeronautical  Systems 
Division  is  currently  concerned  about  their  continuing 
loss  of  rated  supplements.  In  a  product  division 
concerned  mainly  with  buying  aircraft,  rated  experience  is 
invaluable.  This  trend  has  a  great  potential  for 
degrading  ASD's  system  safety  support.  System  safety 
manpower  in  general  is  an  area  of  concern  for  the  program 
management  community  as  well.  A  quarter  of  the  program 
management  personnel  offering  suggestions  on  how  to 
improve  system  safety's  contribution  to  their  program  said 
give  them  more  people.  This,  of  course,  seems  to  be  a 
panacea  for  all  areas  of  acquisition.  Unfortunately,  in 
this  time  of  tight  budgets,  the  motto  will  probably 
continue  to  be  "do  more  with  less." 

Recommendations 

The  following  recommendations  are  made  based  on  the 
responses  to  the  structured  interviews.  In  addition,  the 
researcher's  opinions  are  included  based  on  his  experience 
and  analysis  of  the  subject  area. 
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1.  Increased  emphasis  on  system  safety  is  needed  at 
the  higher  management  levels.  To  be  effective,  system 
safety  personnel  need  to  be  allowed  to  do  their  jobs.  If 
some  kind  of  direction  or  even  information  about  system 
safety  from  command  level  offices  was  disseminated,  SPOs 
may  be  more  receptive  to  accepting  the  suggestions  of  the 
system  safety  community.  System  safety  representatives 
should  solicit  support  from  product  division  commanders, 
and  two-letter  directors. 

2.  A  section  on  system  safety  should  be  included  in 
the  introductory  level  acquisition  courses,  such  as 
Systems  100  and  200,  which  are  offered  by  AFIT,  and  at  the 
orientation  classes  given  at  each  product  division.  This 
would  expose  new  acquisition  personnel  to  system  safety 
very  early  and  at  least  make  them  familiar  with  the 
purpose  and  concept  of  the  discipline. 

3.  The  Air  Force  Inspection  and  Safety  Center  should 
develop  a  computerized  data  base  containing  lessons 
learned  and  proven  design  criteria  that  can  be  used  to 
avoid  repeating  mistakes.  A  program  such  as  this  could  be 
used  during  design,  source  selection,  and  throughout  full- 
scale  development. 

4.  System  safety  managers  need  to  be  more  involved 
with  their  programs  to  be  able  to  effectively  tailor  their 
system  safety  programs  to  each  system.  This  would  help 
reduce  unnecessary  requirements  and  improve  ccst- 
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effectiveness,  as  well  as  improve  relations  with  the  SPO 
personnel . 

Closing  Remarks 

In  general,  system  safety  seems  to  be  effective  and 
respected  in  the  system  acquisition  process.  An 
additional  study  should  be  conducted  in  two  years  to  see 
what  effects,  if  any,  the  AFSC  Form  180  has  on  the 
perception  of  system  safety.  It  would  also  determine 
whether  or  not  there  is  an  increase  in  emphasis  on  system 
safety  occurring.  Another  area  of  research  that  would  be 
worthwhile  is  in  the  area  of  promotion  rates  in  system 
safety.  If,  in  fact,  fewer  personnel  get  promoted  in 
system  safety,  something  needs  to  be  done  to  change  it. 
Systems  Command  needs  to  ensure  that  the  people  entering 
system  safety  are  promotable  and  not  being  shoved  into 
system  safety  to  "get  rid  of  them."  Too  many  of  these 
people  tend  to  give  the  impression  that  system  safety  is  a 
dead-end  field  where  nobody  gets  promoted. 

A  research  effort  such  as  this  thesis  would  be  useful 
if  it  was  conducted  periodically  to  keep  a  finger  on  the 
pulse  of  system  safety. 
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APPENDIX  A 


structured  interview  for  system  safety  personnel 

1)  What  is  your  current  duty  title? 

2)  What  is  your  educational  background? 

3)  How  much  experience  do  you  have  in  system  safety? 

4)  What  system  safety  training  have  you  had? 

5)  What  programs  do  you  currently  have  system  safety 
responsibility  for? 

6)  What  office  is  your  reporting  official  located  in? 

7)  How  would  you  describe  your  working  relationship  with 
the  program  office  personnel  you  work  with? 

8)  What  are  your  views  on  the  impact  your  system  safety 
program  has  on  your  acquisition  programs? 

9  )  What  trends  are  developing  in  the  discipline  of  system 
safety? 
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APPENDIX  B 


STRUCTURED  INTERVIEW  FOR  PROGRAM  MANAGEMENT  PERSONNEL 

1)  What  is  your  current  duty  title? 

2)  What  acquisition  programs  are  you  responsible  for? 

3)  How  familiar  are  you  with  the  discipline  of  system 
safety? 

4)  Do  you  know  who  has  system  safety  responsibility  for 
your  programs? 

5)  How  do  you  view  the  discipline  of  system  safety? 

6)  Does  system  safety  contribute  to  your  programs? 

7)  Is  system  safety  cost-effective? 

8)  How  could  system  safety  be  improved  to  enhance  its 
value  to  your  programs? 

9)  Have  you  received  any  guidance  from  higher 
headquarters  concerning  system  safety? 


Glossary 


Hazard.  A  condition  that  is  prerequisite  to  a  mishap 

(6:2). 

Hazardous  Event.  An  occurrence  that  creates  a  hazard 
(6:2) 

Hazard  Probabi 1 ity .  The  aggregate  probability  of 
occurrence  of  the  individual  hazardous  events  that  create 
a  specific  hazard  (6:2). 

Hazard  Severity .  An  assessment  of  the  worst  credible 
mishap  that  could  be  caused  by  a  specific  hazard  (6:2). 

Implementing  Command .  The  coittmand  or  agency  designated  by 
HQ  USAF  to  manage  an  acquisition  program.  Includes 
modification  programs  (2:11) 

Managing  Activity .  The  organizational  element  of  DOD 
assigned  acquisition  management  responsibility  for  the 
system,  or  prime  or  associate  contractors  or 
subcontractors  who  wish  to  impose  system  safety  tasks  on 
their  suppliers  (6:2). 

Mishap.  An  unplanned  event  or  series  of  events  that 
results  in  death,  injury,  occupational  illness,  or  damage 
to  or  loss  of  equipment  or  property  (6:2). 

Off-the-Shelf  Item.  An  item  determined  by  a  material 
acquisition  decision  process  review  (DOD,  Military 
Component,  or  subordinate  organization  as  appropriate)  to 
be  available  for  acquisition  to  satisfy  an  approved 
material  requirement  with  no  expenditures  of  funds  for 
development,  modification,  of  improvement  (6:2-3). 

Risk.  An  expression  of  the  possibility  of  a  mishap  in 
terms  of  hazard  severity  and  hazard  probability  (6:3). 

Safety.  Freedom  from  those  conditions  that  can  cause 
death,  injury,  occupational  illness,  or  damage  to  or  loss 
of  equipment  or  property  (6:3). 

Supporting  Command.  The  command  assigned  responsibility 
for  providing  logistic  support;  it  assumes  program 
management  responsibility  from  the  implementing  command 
(2:11). 
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System  Safety .  The  application  of  engineering  and 
management  principles,  criteria,  and  techniques  to 
optimize  safety  within  the  constraints  of  operational 
effectiveness,  time,  and  cost  throughout  all  phases  of  the 
system  life  cycle  (6:3). 

System  Safety  Program .  The  combined  tasks  and  activities 
of  system  safety  management  and  system  safety  engineering 
that  enhance  operational  effectiveness  by  satisfying  the 
system  safety  requirements  in  a  timely,  cost-effective 
manner  throughout  all  phases  of  the  system  life  cycle 
(6:3). 

System  Safety  Program  Plan.  A  description  of  the  planned 
methods  to  be  used  by  the  contractor  to  implement  the 
tailored  requirements  of  MIL-STD-082B,  including 
organizational  responsibilities,  resources,  methods  of 
accomplishment,  milestones,  depth  of  effort,  and 
integration  with  other  program  engineering  and  management 
activities  and  related  systems  (6:4). 
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